CVE-2004-0970 The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files. NOTE: th...
LowCVSS 2.1
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files. NOTE: the znew vulnerability may overlap CVE-2003-0367.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU gzip | = 1.2.4a | No fix listed |
| debian/gzip(Debian:12) | < 1.3.5-8 | 1.3.5-8 |
| debian/gzip(Debian:13) | < 1.3.5-8 | 1.3.5-8 |
| debian/gzip(Debian:14) | < 1.3.5-8 | 1.3.5-8 |
References
- 13131 third-party-advisory
- DSA-588 vendor-advisory
- 11288 patch vdb-entry vendor-advisory
- 2004-0050 vendor-advisory
- www.zataz.net
- script-temporary-file-overwrite(17583) vdb-entry
- Debian Security Tracker CVE-2004-0970 vendor-advisory
- bugs.debian.org issue-tracking