CVE-2005-1228 Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed fil...
MediumCVSS 5.0
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU gzip | = 1.2.4 | No fix listed |
| GNU gzip | = 1.3.3 | No fix listed |
| debian/gzip(Debian:12) | < 1.3.5-10 | 1.3.5-10 |
| debian/gzip(Debian:13) | < 1.3.5-10 | 1.3.5-10 |
| debian/gzip(Debian:14) | < 1.3.5-10 | 1.3.5-10 |
References
- bugs.debian.org patch
- APPLE-SA-2006-08-01 vendor-advisory
- 20050420 gzip directory traversal vulnerability mailing-list
- RHSA-2005:357 vendor-advisory
- 15047 third-party-advisory vendor-advisory
- 18100 third-party-advisory
- 21253 third-party-advisory
- 22033 third-party-advisory
- SSA:2006-262 vendor-advisory
- 101816 vendor-advisory
- DSA-752 vendor-advisory
- 15721 vdb-entry
- 19289 vdb-entry
- TA06-214A third-party-advisory us-government-resource
- ADV-2006-3101 vdb-entry
- gzip-n-directory-traversal(20199) vdb-entry
- oval:org.mitre.oval:def:11057 signature vdb-entry
- oval:org.mitre.oval:def:170 signature vdb-entry
- oval:org.mitre.oval:def:382 signature vdb-entry
- Debian Security Tracker CVE-2005-1228 vendor-advisory