CVE-2005-0758

Severity Score

9.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2005-03-17 CVE Reserved
2005-05-13 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (28)

URL	Tag	Source
http://bugs.gentoo.org/show_bug.cgi?id=90626	Third Party Advisory
http://docs.info.apple.com/article.html?artnum=306172	Third Party Advisory
http://secunia.com/advisories/18100	Third Party Advisory
http://secunia.com/advisories/19183	Third Party Advisory
http://secunia.com/advisories/22033	Third Party Advisory
http://secunia.com/advisories/26235	Third Party Advisory
http://securitytracker.com/id?1013928	Third Party Advisory
http://www.osvdb.org/16371	Broken Link
http://www.securityfocus.com/bid/13582	Third Party Advisory
http://www.securityfocus.com/bid/25159	Third Party Advisory
http://www.vupen.com/english/advisories/2007/2732	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/20539	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1081	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1107	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9797	Signature

URL	Date	SRC

URL	Date	SRC
http://www.gentoo.org/security/en/glsa/glsa-200505-05.xml	2019-10-16

URL	Date	SRC
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.58/SCOSA-2005.58.txt	2019-10-16
ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc	2019-10-16
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	2019-10-16
http://rhn.redhat.com/errata/RHSA-2005-357.html	2019-10-16
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.555852	2019-10-16
http://www.mandriva.com/security/advisories?name=MDKSA-2006:026	2019-10-16
http://www.mandriva.com/security/advisories?name=MDKSA-2006:027	2019-10-16
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.002.html	2019-10-16
http://www.redhat.com/support/errata/RHSA-2005-474.html	2019-10-16
http://www.ubuntu.com/usn/usn-158-1	2019-10-16
https://access.redhat.com/security/cve/CVE-2005-0758	2005-06-16
https://bugzilla.redhat.com/show_bug.cgi?id=1617573	2005-06-16

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				< 1.3.5 Search vendor "Gnu" for product "Gzip" and version " < 1.3.5"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				4.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "4.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				5.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "5.04"		-		Affected