CVE-2004-0970

CWE-20 — Improper Input ValidationCWE-596 documents6 sources
Severity
2.1LOW
EPSS
0.1%
top 73.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Gzip
Timeline
PublishedFeb 9
Latest updateApr 29

Description

The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files. NOTE: the znew vulnerability may overlap CVE-2003-0367.

CVSS vector

AV:L/AC:L/C:N/I:P/A:NExploitability: 3.9 | Impact: 2.9

Affected Packages2 packages

▶Debiangzip< 1.3.5-8+3
▶NVDgnu/gzip1.2.4a

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-2jrh-9rrj-2f59: The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files↗2022-04-29
▶
OSV
CVE-2004-0970: The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files↗2005-02-09
▶
CVEList
CVE-2004-0970: The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files↗2004-10-20
▶

📋Vendor Advisories

2
Red Hat
ncompress: insecure tmp file handling may lead to file overwrite↗2021-11-09
▶
Debian
CVE-2004-0970: gzip - The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by o...↗2004
▶