USN-8733-2

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8733-2
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8733-2.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8733-2
Upstream
CVE (2)
Related
UBUNTU (2)
Published
2026-09-22T16:04:21Z
Modified
2026-09-23T18:57:40Z
Summary
gzip vulnerabilities
Details

USN-8733-1 fixed vulnerabilities in Gzip. This update provides the corresponding fix for Gzip on Ubuntu 14.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. (CVE-2026-41991)

Elias Hasas, Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip incorrectly handled certain compressed files. An attacker could possibly use this issue to obtain sensitive information or cause Gzip to crash, resulting in a denial of service. (CVE-2026-41992)

References

Affected packages

Ubuntu:Pro:14.04:LTS / gzip

Package

Name
gzip
Purl
pkg:deb/ubuntu/gzip?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6-3ubuntu1+esm2

Affected versions

1.*
1.6-2ubuntu1
1.6-3ubuntu1
1.6-3ubuntu1+esm1

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "gzip",
            "binary_version":  "1.6-3ubuntu1+esm2"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-41991",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-41992",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:Pro:14.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8733-2.json"

Ubuntu:Pro:18.04:LTS / gzip

Package

Name
gzip
Purl
pkg:deb/ubuntu/gzip?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6-5ubuntu1.2+esm1

Affected versions

1.*
1.6-5ubuntu1
1.6-5ubuntu1.1
1.6-5ubuntu1.2

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "gzip",
            "binary_version":  "1.6-5ubuntu1.2+esm1"
        },
        {
            "binary_name":  "gzip-win32",
            "binary_version":  "1.6-5ubuntu1.2+esm1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-41991",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-41992",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:Pro:18.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8733-2.json"

Ubuntu:Pro:20.04:LTS / gzip

Package

Name
gzip
Purl
pkg:deb/ubuntu/gzip?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.10-0ubuntu4.1+esm1

Affected versions

1.*
1.10-0ubuntu3
1.10-0ubuntu4
1.10-0ubuntu4.1

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "gzip",
            "binary_version":  "1.10-0ubuntu4.1+esm1"
        },
        {
            "binary_name":  "gzip-win32",
            "binary_version":  "1.10-0ubuntu4.1+esm1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-41991",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-41992",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:Pro:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8733-2.json"