Vulnerability-Lookup

SUSE-SU-2026:22906-1

Vulnerability from csaf_suse - Published: 2026-07-24 07:22 - Updated: 2026-09-16 20:07

Summary

Security update for gzip

Severity

Important

Notes

Title of the patch: Security update for gzip

Description of the patch: This update for gzip fixes the following issue - CVE-2026-41991: insecure temporary file handling in the `gzexe` utility when the `mktemp` utility is not available in a user's `PATH` (bsc#1269622).

Patchnames: SUSE-SLE-Micro-6.1-637

CVE-2026-41991

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.x86_64	—	Vendor Fix

Threats

Impact important

References

9 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1269622	self
https://www.suse.com/security/cve/CVE-2026-41991/	self
https://www.suse.com/security/cve/CVE-2026-41991	external
https://bugzilla.suse.com/1269622	external
https://bugzilla.suse.com/1269623	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for gzip",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for gzip fixes the following issue\n\n- CVE-2026-41991: insecure temporary file handling in the `gzexe` utility when the `mktemp` utility is not available in\n  a user\u0027s `PATH` (bsc#1269622).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-637",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22906-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22906-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622906-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22906-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027857.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1269622",
        "url": "https://bugzilla.suse.com/1269622"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41991 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41991/"
      }
    ],
    "title": "Security update for gzip",
    "tracking": {
      "current_release_date": "2026-09-16T20:07:45Z",
      "generator": {
        "date": "2026-07-24T07:22:19Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22906-1",
      "initial_release_date": "2026-07-24T07:22:19Z",
      "revision_history": [
        {
          "date": "2026-07-24T07:22:19Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:19:29Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:07:45Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gzip-1.13-slfo.1.1_3.1.aarch64",
                "product": {
                  "name": "gzip-1.13-slfo.1.1_3.1.aarch64",
                  "product_id": "gzip-1.13-slfo.1.1_3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gzip:1.13:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gzip@1.13-slfo.1.1_3.1?arch=aarch64\u0026upstream=gzip-1.13-slfo.1.1_3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gzip-1.13-slfo.1.1_3.1.ppc64le",
                "product": {
                  "name": "gzip-1.13-slfo.1.1_3.1.ppc64le",
                  "product_id": "gzip-1.13-slfo.1.1_3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gzip:1.13:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gzip@1.13-slfo.1.1_3.1?arch=ppc64le\u0026upstream=gzip-1.13-slfo.1.1_3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gzip-1.13-slfo.1.1_3.1.s390x",
                "product": {
                  "name": "gzip-1.13-slfo.1.1_3.1.s390x",
                  "product_id": "gzip-1.13-slfo.1.1_3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gzip:1.13:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gzip@1.13-slfo.1.1_3.1?arch=s390x\u0026upstream=gzip-1.13-slfo.1.1_3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gzip-1.13-slfo.1.1_3.1.x86_64",
                "product": {
                  "name": "gzip-1.13-slfo.1.1_3.1.x86_64",
                  "product_id": "gzip-1.13-slfo.1.1_3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gzip:1.13:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gzip@1.13-slfo.1.1_3.1?arch=x86_64\u0026upstream=gzip-1.13-slfo.1.1_3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gzip-1.13-slfo.1.1_3.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.aarch64"
        },
        "product_reference": "gzip-1.13-slfo.1.1_3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gzip-1.13-slfo.1.1_3.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.ppc64le"
        },
        "product_reference": "gzip-1.13-slfo.1.1_3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gzip-1.13-slfo.1.1_3.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.s390x"
        },
        "product_reference": "gzip-1.13-slfo.1.1_3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gzip-1.13-slfo.1.1_3.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.x86_64"
        },
        "product_reference": "gzip-1.13-slfo.1.1_3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41991",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41991"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user\u0027s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre-create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time-of-check to time-of-use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.aarch64",
          "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.ppc64le",
          "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.s390x",
          "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41991",
          "url": "https://www.suse.com/security/cve/CVE-2026-41991"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269622 for CVE-2026-41991",
          "url": "https://bugzilla.suse.com/1269622"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269623 for CVE-2026-41991",
          "url": "https://bugzilla.suse.com/1269623"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.aarch64",
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.ppc64le",
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.s390x",
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.aarch64",
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.ppc64le",
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.s390x",
            "SUSE Linux Micro 6.1:gzip-1.13-slfo.1.1_3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-24T07:22:19Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-41991"
    }
  ]
}

CVE-2026-41991 (GCVE-0-2026-41991)

Vulnerability from cvelistv5 – Published: 2026-06-29 10:15 – Updated: 2026-06-29 13:31 X_Open Source

Title

Predictable Temporary File in GNU gzip

Summary

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 13:31 UTC

CWE

CWE-377 - Insecure Temporary File

Assigner

CERT-PL ENISA root

References

3 references

URL	Tags
https://cert.pl/en/posts/2026/04/CVE-2026-41991/	third-party-advisory
https://www.gnu.org/software/gzip/	product
https://cgit.git.savannah.gnu.org/cgit/gzip.git/c…	patch

Impacted products

1 product

Vendor	Product	Version
GNU	gzip	Affected: 0 , ≤ 1.14 (semver)

Credits

Michał Majchrowicz (AFINE) Marcin Wyczechowski (AFINE)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T13:31:34.387147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T13:31:46.581Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gzip",
          "repo": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/",
          "vendor": "GNU",
          "versions": [
            {
              "lessThanOrEqual": "1.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Micha\u0142 Majchrowicz (AFINE)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcin Wyczechowski (AFINE)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user\u2019s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\u003cbr\u003eA local attacker can pre\u2011create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time\u2011of\u2011check to time\u2011of\u2011use (TOCTOU) condition that allows arbitrary file overwrite.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269\u003c/p\u003e"
            }
          ],
          "value": "GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user\u2019s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre\u2011create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time\u2011of\u2011check to time\u2011of\u2011use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-377",
              "description": "CWE-377: Insecure Temporary File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T10:15:50.766Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://cert.pl/en/posts/2026/04/CVE-2026-41991/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.gnu.org/software/gzip/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Predictable Temporary File in GNU gzip",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2026-41991",
    "datePublished": "2026-06-29T10:15:50.766Z",
    "dateReserved": "2026-04-23T08:06:09.511Z",
    "dateUpdated": "2026-06-29T13:31:46.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.