Your message dated Sat, 05 Sep 2026 15:32:08 +0000
with message-id <[email protected]>
and subject line Bug#1141443: fixed in gzip 1.13-1+deb13u1
has caused the Debian Bug report #1141443,
regarding gzip: CVE-2026-41992
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141443: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141443
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gzip
Version: 1.13-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for gzip.
CVE-2026-41992[0]:
| GNU gzip contains a global buffer overflow vulnerability in the LZH
| decompression logic caused by improper reuse of shared global state
| between different decompression formats within a single execution.
| GNU gzip maintains a global array that is shared across the LZ77,
| LZW, and LZH decompression routines and is not reinitialized between
| files processed in the same invocation. By decompressing a specially
| crafted LZW file followed by a specially crafted LZH file in a
| single gzip -d command, an attacker can poison the shared global
| state and subsequently trigger an out‑of‑bounds read in the LZH
| decoder. The LZH decompression logic follows stale values left in
| the shared array, causing reads past the end of the allocated global
| buffer. This issue has been fixed in the commit
| 63dbf6b3b9e6e781df1a6a64e609b10e23969681
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-41992
https://www.cve.org/CVERecord?id=CVE-2026-41992
[1]
https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: gzip
Source-Version: 1.13-1+deb13u1
Done: Milan Kupcevic <[email protected]>
We believe that the bug you reported is fixed in the latest version of
gzip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Milan Kupcevic <[email protected]> (supplier of updated gzip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 24 Aug 2026 17:59:51 -0400
Source: gzip
Architecture: source
Version: 1.13-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Milan Kupcevic <[email protected]>
Changed-By: Milan Kupcevic <[email protected]>
Closes: 1141442 1141443
Changes:
gzip (1.13-1+deb13u1) trixie; urgency=medium
.
* d/p/CVE-2026-41991-a.patch, d/p/CVE-2026-41991-b.patch: use -C if
lacking mktemp, closes: #1141442, CVE-2026-41991
* d/p/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z,
closes: #1141443, CVE-2026-41992
Checksums-Sha1:
da29a1d6cbffd22cf19ba0acb51355aedae2c985 1708 gzip_1.13-1+deb13u1.dsc
8a722d74425395decd1588fb5b79a2ca97d5e549 21364
gzip_1.13-1+deb13u1.debian.tar.xz
7ff57df80023a2199a38313960f5ca7c34a50315 6325
gzip_1.13-1+deb13u1_amd64.buildinfo
Checksums-Sha256:
0c25763da4f7242fbe7e9185b69bcb3f986011b04446b66a84c52bbdf731d308 1708
gzip_1.13-1+deb13u1.dsc
ffc69d13290009f42dbb4d10a34839350eff3fdaf4be1fda03d10b238ba2f77d 21364
gzip_1.13-1+deb13u1.debian.tar.xz
f7e42973c1acb448431353123c4fbb75ead7e2c77072f701a08423d93fe0fc3b 6325
gzip_1.13-1+deb13u1_amd64.buildinfo
Files:
5976c64ae61b3af3fe844d22cf699723 1708 utils required gzip_1.13-1+deb13u1.dsc
d2c8e569ae5148078ab4261dc10efcb9 21364 utils required
gzip_1.13-1+deb13u1.debian.tar.xz
024002db31fb65962b264fa3dedb02ad 6325 utils required
gzip_1.13-1+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQHFBAEBCgAvFiEEVkf/m69krCYf+z+G6e1ngbRVCQ4FAmqcEE8RHG1pbGFuQGRl
Ymlhbi5vcmcACgkQ6e1ngbRVCQ6l2AwA4SEEGQFmN3wTaDXe/S30DTx/0N++L5ma
fAEmoq0WqVX+r9/sgWpfwb7+MwO9cJVpx/iFv9NLOR2nPMuYmD+rZ9+e+HA7txsS
yvOXtVp4jfuWk0FaTM1kiKA210lHoy4q7enSWErcF0tj1+KTRAQVaQ/10YgkYcNh
pQVJvzuIzcfa0pSpoLf+58i3m1tDBgBnxFR7xShclShmsIo8XVLeRluD5wywIBnQ
IkB0MmLQGgN8S09iz7aevDNRj8Jjbr+A0Oisb0DFZm96+HaHYZ7/o7pGwXNHqHf8
DnBaWev50w6RqewKv2BOBkuKc3O+ozwxFG7jkdvD7/BGWC/cbyZ3+jxDwdbG4Tkz
h1qlG7+OeaSvQ/PHFaOFoIhdhbXz+IKIskjbILiGWVGzavDJbeXfu1vIH6KUFg+y
5GjzUcIq7cIuCB+WuR3s8G/MzX1TRcmO2nbf/HuEHwD7yBXLxJ5TqYrWRAquAo4z
81ZqsUGd5PZ2UFTLLaPQPfOdwW6KvK5W
=f9Da
-----END PGP SIGNATURE-----
pgpRkzw3eN6cW.pgp
Description: PGP signature
--- End Message ---
