Version in base suite: 1.13-1 Base version: gzip_1.13-1 Target version: gzip_1.13-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gzip/gzip_1.13-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gzip/gzip_1.13-1+deb13u1.dsc changelog | 9 +++ patches/CVE-2026-41991-a.patch | 65 +++++++++++++++++++++++++++ patches/CVE-2026-41991-b.patch | 96 +++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-41992.patch | 60 +++++++++++++++++++++++++ patches/series | 3 + 5 files changed, 233 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpdcf9m1ud/gzip_1.13-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpdcf9m1ud/gzip_1.13-1+deb13u1.dsc: no acceptable signature found diff -Nru gzip-1.13/debian/changelog gzip-1.13/debian/changelog --- gzip-1.13/debian/changelog 2025-01-17 04:18:44.000000000 +0000 +++ gzip-1.13/debian/changelog 2026-08-24 21:59:51.000000000 +0000 @@ -1,3 +1,12 @@ +gzip (1.13-1+deb13u1) trixie; urgency=medium + + * d/p/CVE-2026-41991-a.patch, d/p/CVE-2026-41991-b.patch: use -C if + lacking mktemp, closes: #1141442, CVE-2026-41991 + * d/p/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z, + closes: #1141443, CVE-2026-41992 + + -- Milan Kupcevic Mon, 24 Aug 2026 17:59:51 -0400 + gzip (1.13-1) sid; urgency=medium [ Milan Kupcevic ] diff -Nru gzip-1.13/debian/patches/CVE-2026-41991-a.patch gzip-1.13/debian/patches/CVE-2026-41991-a.patch --- gzip-1.13/debian/patches/CVE-2026-41991-a.patch 1970-01-01 00:00:00.000000000 +0000 +++ gzip-1.13/debian/patches/CVE-2026-41991-a.patch 2026-08-24 21:59:51.000000000 +0000 @@ -0,0 +1,65 @@ +From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 16 Apr 2026 12:11:44 -0700 +Subject: gzexe: use -C if lacking mktemp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +(Problem reported by Michał Majchrowicz.) +* gzexe.in: If mktemp is needed but not installed, +use ‘set -C’ to avoid a race when creating a temporary file. +* zdiff.in: Use the same pattern here, even though the old +code was probably OK anyway. +Origin: backport, https://cgit.git.savannah.gnu.org/cgit/gzip.git/patch/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269 +Bug-Debian: https://bugs.debian.org/1141442 +--- + NEWS | 5 +++++ + gzexe.in | 1 + + zdiff.in | 7 +++---- + 3 files changed, 9 insertions(+), 4 deletions(-) + +#diff --git a/NEWS b/NEWS +#index c053c57..37325ef 100644 +#--- a/NEWS +#+++ b/NEWS +#@@ -15,6 +15,11 @@ GNU gzip NEWS -*- outline -*- +# after decompressing a .Z file. +# [bug present since the beginning] +# +#+ On old-fashioned or limited platforms lacking mktemp, gzexe and +#+ zdiff no longer have a race when creating a temporary file. +#+ [bug present since the beginning] +#+ +#+ +# ** Changes in behavior +# +# gzip -l now reports "-Inf%" instead of "0.0%" for the infinite +--- a/gzexe.in ++++ b/gzexe.in +@@ -128,6 +128,7 @@ for i do + tmp=`mktemp "${dir}gzexeXXXXXXXXX"` + else + tmp=${dir}gzexe$$ ++ (umask 77; set -C; > "$tmp") + fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || { + res=$? + printf >&2 '%s\n' "$0: cannot copy $file" +--- a/zdiff.in ++++ b/zdiff.in +@@ -157,12 +157,11 @@ case $file2 in + *) TMPDIR=/tmp/;; + esac + if type mktemp >/dev/null 2>&1; then +- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` || +- exit 2 ++ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` + else +- set -C + tmp=${TMPDIR}zdiff$$ +- fi ++ (umask 77; set -C; > "$tmp") ++ fi && + 'gzip' -cdfq -- "$file2" > "$tmp" || exit 2 + gzip_status=$( + exec 4>&1 diff -Nru gzip-1.13/debian/patches/CVE-2026-41991-b.patch gzip-1.13/debian/patches/CVE-2026-41991-b.patch --- gzip-1.13/debian/patches/CVE-2026-41991-b.patch 1970-01-01 00:00:00.000000000 +0000 +++ gzip-1.13/debian/patches/CVE-2026-41991-b.patch 2026-08-24 21:59:51.000000000 +0000 @@ -0,0 +1,96 @@ +From 0dfab98769f932242687becf69470ca8d6d5c9a6 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 16 Apr 2026 13:23:03 -0700 +Subject: znew: use -C + +* znew.in: Also use -C here, when creating a temp. +Origin: upstream, https://cgit.git.savannah.gnu.org/cgit/gzip.git/patch/?id=0dfab98769f932242687becf69470ca8d6d5c9a6 +Bug-Debian: https://bugs.debian.org/1141442 +--- + NEWS | 4 ++-- + znew.in | 23 +++++++++++++++++------ + 2 files changed, 19 insertions(+), 8 deletions(-) + +#diff --git a/NEWS b/NEWS +#index 37325ef..3bcefa2 100644 +#--- a/NEWS +#+++ b/NEWS +#@@ -15,8 +15,8 @@ GNU gzip NEWS -*- outline -*- +# after decompressing a .Z file. +# [bug present since the beginning] +# +#- On old-fashioned or limited platforms lacking mktemp, gzexe and +#- zdiff no longer have a race when creating a temporary file. +#+ On old-fashioned or limited platforms lacking mktemp, gzexe, zdiff +#+ and znew no longer have a race when creating a temporary file. +# [bug present since the beginning] +# +# +#diff --git a/znew.in b/znew.in +#index 6d4ea2c..40a2f5d 100644 +--- a/znew.in ++++ b/znew.in +@@ -89,6 +89,8 @@ if test -n "$opt"; then + opt="-$opt" + fi + ++mktemp_status= ++ + for i do + n=`printf '%s\n' "$i" | sed 's/.Z$//'` + if test ! -f "$n.Z" ; then +@@ -107,7 +109,16 @@ for i do + fi + else + if test $check -eq 1; then +- if cp -p "$n.Z" "$n.$$"; then ++ if test -z "$mktemp_status"; then ++ command -v mktemp >/dev/null 2>&1 ++ mktemp_status=$? ++ fi ++ if if test $mktemp_status -eq 0; then ++ tmp=`mktemp "$n.XXXXXXXXX"` ++ else ++ tmp=$n.$$ ++ (umask 77; set -C; > "$tmp") ++ fi && cp -p "$n.Z" "$tmp"; then + : + else + printf '%s\n' "cannot backup $n.Z" +@@ -117,7 +128,7 @@ for i do + if 'gzip' -d "$n.Z"; then + : + else +- test $check -eq 1 && mv "$n.$$" "$n.Z" ++ test $check -eq 1 && mv "$tmp" "$n.Z" + printf '%s\n' "error while uncompressing $n.Z" + res=1; continue + fi +@@ -125,7 +136,7 @@ for i do + : + else + if test $check -eq 1; then +- mv "$n.$$" "$n.Z" && rm -f "$n" ++ mv "$tmp" "$n.Z" && rm -f "$n" + printf '%s\n' "error while recompressing $n" + else + # compress $n (might be dangerous if disk full) +@@ -140,15 +151,15 @@ for i do + if test $pipe -eq 1; then + rm -f "$n$ext" + else +- mv "$n.$$" "$n.Z" && rm -f "$n$ext" ++ mv "$tmp" "$n.Z" && rm -f "$n$ext" + fi + printf '%s\n' "$n.Z smaller than $n$ext -- unchanged" + + elif test $check -eq 1; then + if 'gzip' -t "$n$ext" ; then +- rm -f "$n.$$" "$n.Z" ++ rm -f "$tmp" "$n.Z" + else +- test $pipe -eq 0 && mv "$n.$$" "$n.Z" ++ test $pipe -eq 0 && mv "$tmp" "$n.Z" + rm -f "$n$ext" + printf '%s\n' "error while testing $n$ext, $n.Z unchanged" + res=1; continue diff -Nru gzip-1.13/debian/patches/CVE-2026-41992.patch gzip-1.13/debian/patches/CVE-2026-41992.patch --- gzip-1.13/debian/patches/CVE-2026-41992.patch 1970-01-01 00:00:00.000000000 +0000 +++ gzip-1.13/debian/patches/CVE-2026-41992.patch 2026-08-24 21:59:51.000000000 +0000 @@ -0,0 +1,60 @@ +From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Wed, 15 Apr 2026 12:00:17 -0700 +Subject: gzip: don’t mishandle .lzh after .Z +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Problem reported by Michał Majchrowicz. +* unlzh.c (read_c_len): Clear left and right when n == 0. +Origin: upstream, https://cgit.git.savannah.gnu.org/cgit/gzip.git/patch/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681 +Bug-Debian: https://bugs.debian.org/1141443 +--- + NEWS | 4 ++++ + THANKS | 1 + + unlzh.c | 6 ++++++ + 3 files changed, 11 insertions(+) + +#diff --git a/NEWS b/NEWS +#index 45ac0af..c053c57 100644 +#--- a/NEWS +#+++ b/NEWS +#@@ -11,6 +11,10 @@ GNU gzip NEWS -*- outline -*- +# A use of uninitialized memory on some malformed inputs has been fixed. +# [bug present since the beginning] +# +#+ A buffer overflow has been fixed when decompressing an .lzh file +#+ after decompressing a .Z file. +#+ [bug present since the beginning] +#+ +# ** Changes in behavior +# +# gzip -l now reports "-Inf%" instead of "0.0%" for the infinite +#diff --git a/THANKS b/THANKS +#index 4e545d9..a7d25e4 100644 +#--- a/THANKS +#+++ b/THANKS +#@@ -187,6 +187,7 @@ Richard Lloyd R.K.Lloyd@csc.liv.ac.uk +# Mohamed Maatallah zephyrofficialdiscord@gmail.com +# David J. MacKenzie djm@eng.umd.edu +# John R MacMillan john@chance.gts.org +#+Michał Majchrowicz mmajchrowicz@afine.com +# Ron Male male@eso.mc.xerox.com +# Jakub Martisko jamartis@redhat.com +# Don R. Maszle maze@bea.lbl.gov +--- a/unlzh.c ++++ b/unlzh.c +@@ -239,6 +239,12 @@ read_c_len () + c = getbits(CBIT); + for (i = 0; i < NC; i++) c_len[i] = 0; + for (i = 0; i < 4096; i++) c_table[i] = c; ++ ++ /* Needed in case LEFT and RIGHT are reused from a previous ++ LZW decompression. It may be overkill to clear all of both ++ arrays, but nobody has had time to analyze this carefully. */ ++ memzero(left, (2 * NC - 1) * sizeof *left); ++ memzero(right, (2 * NC - 1) * sizeof *left); + } else { + i = 0; + while (i < n) { diff -Nru gzip-1.13/debian/patches/series gzip-1.13/debian/patches/series --- gzip-1.13/debian/patches/series 2025-01-16 08:15:43.000000000 +0000 +++ gzip-1.13/debian/patches/series 2026-08-24 21:59:51.000000000 +0000 @@ -1,2 +1,5 @@ gzip_reproducible_build.diff disable-Werror.patch +CVE-2026-41991-a.patch +CVE-2026-41991-b.patch +CVE-2026-41992.patch