Local Command Execution in Gzip by GNU with Unsanitized Arguments

CVE-2005-0758

Summary

The gzip utility, specifically the zgrep command, was found to lack proper sanitization in its argument handling, which permitted local users to execute arbitrary commands. This exploitation occurs when filenames injected into a sed script are not adequately validated. As a result, this vulnerability could allow an attacker to run arbitrary code with the privileges of the user running zgrep, potentially leading to unauthorized actions within the system. Users of affected versions are advised to upgrade to patched releases to mitigate the risk associated with this flaw.

References