Home / mailings

PDF

[USN-8733-2] Gzip vulnerabilities

Posted on 23 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8733-2
September 22, 2026

gzip vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Gzip.

Software Description:
- gzip: GNU compression utilities

Details:

USN-8733-1 fixed vulnerabilities in Gzip. This update provides the
corresponding fix for Gzip on Ubuntu 14.04 LTS, Ubuntu 18.04 LTS and Ubuntu
20.04 LTS.

Original advisory details:

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe
utility created temporary files in an insecure manner when mktemp was
unavailable. A local attacker could possibly use this issue to overwrite
arbitrary files. (CVE-2026-41991)

Elias Hasas, Michał Majchrowicz and Marcin Wyczechowski discovered that
Gzip incorrectly handled certain compressed files. An attacker could
possibly use this issue to obtain sensitive information or cause Gzip to
crash, resulting in a denial of service. (CVE-2026-41992)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
gzip 1.10-0ubuntu4.1+esm1
Available with Ubuntu Pro

Ubuntu 18.04 LTS
gzip 1.6-5ubuntu1.2+esm1
Available with Ubuntu Pro

Ubuntu 14.04 LTS
gzip 1.6-3ubuntu1+esm2
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8733-2
https://ubuntu.com/security/notices/USN-8733-1
CVE-2026-41991, CVE-2026-41992

--===============3263752527684126040==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP