News for hackers. Stuff that matters.

A comment on Arbitrary file write vulnerability in GNU gzip's zgrep utility. Parent comment

Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by TheDong on Monday April 18, 2022 @07:20PM (#31077964)
16 years ago, there was a bug reported to zgrep where files with 1 newline caused it to behave incorrectly. It was patched without a CVE https://git.savannah.gnu.org/cgit/gzip.git/commit/zgrep.in?i...

This year, there was a bug reported to zgrep where files with 2 newlines caused it to behave incorrectly. It got a CVE and a front page hacker news post.

I give it very good odds this vulnerability has seen next to zero exploitation in the wild in either of the two cases above.

[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by bombcar on Monday April 18, 2022 @08:28PM (#31078451)
So we’re 16 years out from the three new line bug.
[ Parent | on HN ]
Re:Arbitrary file write vulnerability in GNU gzip's zgrep ut... by _Algernon_ on Tuesday April 19, 2022 @07:12AM (#31081650)
https://xkcd.com/605/
[ Parent | on HN ]