GNU gzip vulnerabilities

An arbitrary file write vulnerability in GNU gzip's zgrep utility allows an attacker to overwrite arbitrary files. When zgrep processes a crafted file name with multiple newlines, it can write selected content to any file. This is due to insufficient validation of filenames.

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and trigger an out-of-bounds read in the LZH decoder.

GNU gzip has a vulnerability in the gzexe utility related to insecure temporary file handling. When mktemp is not available in the user's PATH, gzexe creates a temporary file with a predictable name based solely on the PID, without exclusive access or existence checks. A local attacker can pre-create this path as a symlink to an arbitrary writable file, causing a TOCTOU condition that allows arbitrary file overwrite.