Moderate Security Update for gzip Package: Addressing Arbitrary File Overwrite and Information Disclosure Vulnerabilities
Summary
ALSA-2026:61625: Moderate: gzip security update. Affects gzip versions < 1.13-4.el10_2. Fixed in 1.13-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gzip package is a widely used data compression utility that allows users to compress regular files, replacing them with files that have a .gz extension while preserving ownership modes, access, and modification times. It is an essential tool in many Unix-like operating systems, including AlmaLinux. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities in the gzip package stem from insecure temporary file handling in the gzexe utility, which can lead to arbitrary file overwrites (CVE-2026-41991). Additionally, a global buffer overflow in LZH decompression can result in information disclosure (CVE-2026-41992). These vulnerabilities can be exploited by attackers to overwrite critical files or gain unauthorized access to sensitive information, posing significant risks to system integrity and confidentiality.
How To Fix
Minimum fixed version
1.13-4.el10_2
This is the first release that contains the fix.
sudo dnf update gzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the gzexe utility until the package is updated. Additionally, ensuring proper file permissions and using secure temporary file handling practices can help mitigate the risk of arbitrary file overwrites.
Conclusion
The gzip package has been identified with moderate vulnerabilities that could lead to serious security issues. Users are strongly advised to update to the latest patched version to protect their systems. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for gzip →
FAQ
The vulnerabilities can lead to arbitrary file overwrites and information disclosure, potentially compromising system security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, avoid using the gzexe utility and ensure proper file permissions to mitigate risks.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to gain unauthorized access or overwrite critical files.
It is recommended to regularly check for updates to your packages, ideally on a weekly basis, to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for gzip.
