CVE-2005-0758

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-05-13 · updated 2026-06-16

Description

zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.

Affected products

Canonical Ubuntu Linux: 4.10, 5.04
GNU gzip: before 1.3.5 — fixed in 1.3.5

How to fix

Upgrade to a fixed version: GNU gzip 1.3.5. Check the vendor advisory for mitigations.

References

http://bugs.gentoo.org/show_bug.cgi?id=90626
http://docs.info.apple.com/article.html?artnum=306172
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://rhn.redhat.com/errata/RHSA-2005-357.html
http://secunia.com/advisories/18100
http://secunia.com/advisories/19183
http://secunia.com/advisories/22033
http://secunia.com/advisories/26235
http://securitytracker.com/id?1013928
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.555852

Get alerted when CVE-2005-0758 or the next vulnerability affects your stack