Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3241-1

Опубликовано: 24 июл. 2026
Источник: suse-cvrf

Описание

Security update for gzip

This update for gzip fixes the following issue:

  • CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the user's PATH (bsc#1269622).

Список пакетов

SUSE Linux Enterprise Server 12 SP5-LTSS
gzip-1.10-4.17.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
gzip-1.10-4.17.1

Ссылки

Описание

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre-create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time-of-check to time-of-use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:gzip-1.10-4.17.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gzip-1.10-4.17.1
Ссылки