CVE-2010-0001: GNU Gzip

Medium severity, CVSS 6.8. EPSS: 4.8% chance of exploitation in the next 30 days.

Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.

Affected products

• GNU Gzip: up to and including 1.3.13; version 1.2.4 only; version 1.2.4a only; version 1.3 only; version 1.3.1 only; version 1.3.2 only; …

Published 2010-01-29. Last modified 2026-06-16.