Public bug reported:
A new release of gzip is available for merging from Debian.
Ubuntu: 1.14-1~exp2ubuntu3
Debian Unstable: 1.14-1
### New Debian Changes ###
gzip (1.14-1) sid; urgency=medium
[ Milan Kupcevic ]
* new upstream release
- gzexe, zdiff, zgrep: Switch scripts from using `type` to
`command -v` to support non-XSI, closes: #513754
* cherry-pick upstream uninitialized read fix
* d/p/CVE-2026-41991-a.patch, d/p/CVE-2026-41991-b.patch: use -C if
lacking mktemp, closes: #1141442, CVE-2026-41991
* d/p/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z,
closes: #1141443, CVE-2026-41992
* d/control: comply to standards version 4.7.4
[ Grayson Wolf ]
* add more complex autopkgtest scripts, closes: #1137242
-- Milan Kupcevic <[email protected]> Sun, 16 Aug 2026 21:14:53 -0400
### Old Ubuntu Delta ###
gzip (1.14-1~exp2ubuntu3) stonking; urgency=medium
* SECURITY UPDATE: insecure temp file handling
- debian/patches/CVE-2026-41991.patch: gzexe: use -C if lacking mktemp in
gzexe.in, zdiff.in.
- CVE-2026-41991
* SECURITY UPDATE: overflow in LZH decompression logic
- debian/patches/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z
in unlzh.c.
- CVE-2026-41992
-- Marc Deslauriers <[email protected]> Fri, 03 Jul 2026
07:50:04 -0400
gzip (1.14-1~exp2ubuntu2) stonking; urgency=medium
* d/tests: add tests for more complex behaviors in the
manpage, including multi-file compression and environment
variables, and roundtrip for more complex files, as right now
the current tests are very basic. (LP: #2153271)
-- Grayson Wolf <[email protected]> Tue, 19 May 2026 09:28:41
-0400
gzip (1.14-1~exp2ubuntu1) resolute; urgency=medium
* Merge from Debian experimental (LP: #2142871). Remaining changes:
- debian/rules: Enable DFLTCC optimisations on s390x by default.
* Dropped changes (fixed upstream):
- d/p/0001-maint-fix-s390-buffer-flushes.patch
- d/rules: define "alignas" to fix FTBFS on s390x
* Cherry-pick upstream fixes:
- gzip: fix uninitialized read
- gzip: fix another uninitialized read
- gzip: fix s390x build failure
-- Benjamin Drung <[email protected]> Fri, 27 Feb 2026 18:02:51 +0100
** Affects: gzip (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: gzip (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: gzip (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171213
Title:
Merge gzip 1.14-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gzip/+bug/2171213/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
