Detections
Analytics

Echo: gzip: security update to 1.13-1+e1

medium Tenable Cloud Security Plugin ID 464732

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper
 reuse of shared global state between different decompression formats within a single execution. GNU gzip
 maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not
 reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW
 file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the
 shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH
 decompression logic follows stale values left in the shared array, causing reads past the end of the
 allocated global buffer. This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and
 e7378c2d421be6a286922374425680bbe9ad8b7d. (CVE-2026-41992)

Solution

Update the gzip library and its related packages to version 1.13-1+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-41992

Plugin Details

Severity: Medium

ID: 464732

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 95.9

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-41992

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/30/2026

Vulnerability Publication Date: 6/29/2026

Reference Information

CVE: CVE-2026-41992