FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2005-1228

This CVE name corresponds to:

Entered	Topic
2005-06-18	gzip -- directory traversal and permission race vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2005-1228 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2005-1228
Phase	Assigned(20050422)

Description

Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file.

References

Source	Reference
BUGTRAQ	20050420 gzip directory traversal vulnerability
CONFIRM	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255
APPLE	APPLE-SA-2006-08-01
DEBIAN	DSA-752
REDHAT	RHSA-2005:357
SCO	SCOSA-2005.58
SLACKWARE	SSA:2006-262
SUNALERT	101816
CERT	TA06-214A
BID	19289
OVAL	oval:org.mitre.oval:def:11057
VUPEN	ADV-2006-3101
OSVDB	15721
OVAL	oval:org.mitre.oval:def:382
OVAL	oval:org.mitre.oval:def:170
SECUNIA	15047
SECUNIA	18100
SECUNIA	21253
SECUNIA	22033
XF	gzip-n-directory-traversal(20199)