CVE-2022-1271

NameCVE-2022-1271
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2976-1, DLA-2977-1, DSA-5122-1, DSA-5123-1, ELA-593-1, ELA-594-1
Debian Bugs1009167, 1009168

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gzip (PTS)jessie, jessie (lts)1.6-4+deb8u1fixed
stretch (security), stretch (lts), stretch1.6-5+deb9u1fixed
buster1.9-3vulnerable
buster (security)1.9-3+deb10u1fixed
bullseye1.10-4vulnerable
bullseye (security)1.10-4+deb11u1fixed
bookworm, sid1.12-1fixed
xz-utils (PTS)jessie, jessie (lts)5.1.1alpha+20120614-2+deb8u1fixed
stretch (security), stretch (lts), stretch5.2.2-1.2+deb9u1fixed
buster5.2.4-1vulnerable
buster (security)5.2.4-1+deb10u1fixed
bullseye5.2.5-2vulnerable
bullseye (security)5.2.5-2.1~deb11u1fixed
bookworm, sid5.2.5-2.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gzipsourcejessie1.6-4+deb8u1ELA-593-1
gzipsourcestretch1.6-5+deb9u1DLA-2976-1
gzipsourcebuster1.9-3+deb10u1DSA-5122-1
gzipsourcebullseye1.10-4+deb11u1DSA-5122-1
gzipsource(unstable)1.12-11009168
xz-utilssourcejessie5.1.1alpha+20120614-2+deb8u1ELA-594-1
xz-utilssourcestretch5.2.2-1.2+deb9u1DLA-2977-1
xz-utilssourcebuster5.2.4-1+deb10u1DSA-5123-1
xz-utilssourcebullseye5.2.5-2.1~deb11u1DSA-5123-1
xz-utilssource(unstable)5.2.5-2.11009167

Notes

https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch
https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148b7bd3c147a81ea00c7c (v1.12)
https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=d74a30d45c6834c8e9f87115197370fe86656d81 (v1.12)
https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=c99f320d5c0fd98fe88d9cea5407eb7ad9d50e8a (v1.12)
https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=6543c09c6ecfb1630085d440b76511953bc5a2cb (v1.12)
https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=0e2d07fc2c4393cfb9dbab580d0bee4525b9c9b3 (v1.12)
https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=5e1fc8b92c1af9382365aef0f9130341ee1d2c76 (v1.12)
Improves further the fix: https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=9d3248751178939713a39115cf68ec8a11506cc9 (v1.12)
https://www.openwall.com/lists/oss-security/2022/04/07/8
https://www.zerodayinitiative.com/advisories/ZDI-22-619/

Search for package or bug name: Reporting problems