Format: 1.8 Date: Fri, 08 Apr 2022 07:05:45 -0400 Source: gzip Binary: gzip Architecture: i386 Version: 1.10-0ubuntu4.1 Distribution: focal Urgency: medium Maintainer: Launchpad Build Daemon Changed-By: Marc Deslauriers Description: gzip - GNU compression utilities Changes: gzip (1.10-0ubuntu4.1) focal-security; urgency=medium . * SECURITY UPDATE: arbitrary file override with crafted file names - debian/patches/CVE-2022-1271-1.patch: avoid exploit via multi-newline file names in zgrep.in. - debian/patches/CVE-2022-1271-2.patch: add test in tests/Makefile.am, tests/zgrep-abuse. - debian/patches/CVE-2022-1271-3.patch: port to POSIX sed in zgrep.in. - debian/patches/CVE-2022-1271-4.patch: optimize out a grep in gzexe.in. - debian/patches/CVE-2022-1271-5.patch: use C locale more often in gzexe.in, sample/zfile, zdiff.in, zgrep.in, znew.in. - debian/patches/CVE-2022-1271-6.patch: fix "binary file matches" mislabeling in tests/Makefile.am, tests/zgrep-binary, zgrep.in. - debian/rules: fix permissions on new test scripts. - CVE-2022-1271 Checksums-Sha1: 40d8a9d374b2fb7eb2c48cd1ebd4904860484a17 99872 gzip-dbgsym_1.10-0ubuntu4.1_i386.ddeb 1f7886ee3db502b9fc403eb450d1fc8a6a264e1a 5606 gzip_1.10-0ubuntu4.1_i386.buildinfo 5ea593da1cd725134712ec5f482bf0869fdb7b83 96640 gzip_1.10-0ubuntu4.1_i386.deb Checksums-Sha256: 1bc4ef28feeb5794debb8705fafcc856fd0c9757f84de71e525420b9bf938a73 99872 gzip-dbgsym_1.10-0ubuntu4.1_i386.ddeb fd161e50f3d7322766b2174827523d795481e4b0155eae91565c68666cf173f9 5606 gzip_1.10-0ubuntu4.1_i386.buildinfo a1c34ea7f7410277cef7f3af028ba277d17202b9cf258dc0c89f65f3b1056352 96640 gzip_1.10-0ubuntu4.1_i386.deb Files: 22210ff75a44cae6ce0dae02a9dd726b 99872 debug optional gzip-dbgsym_1.10-0ubuntu4.1_i386.ddeb 9d717bdf19c2662cd7b1d244af6876e3 5606 utils required gzip_1.10-0ubuntu4.1_i386.buildinfo 92289bf7cc3e2e0591f769b9346258c5 96640 utils required gzip_1.10-0ubuntu4.1_i386.deb Original-Maintainer: Bdale Garbee