CVE-2006-4336

Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent...

7.5 HighFix available

Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted leaf count table that causes a write to a negative index.

Exploit likelihood

5.96%Up 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2006-4336
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-4336
Updated: 2026-11-02

EUVDEUVD-2006-4324 No score

Record: EUVD-2006-4324
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fwv6-j4q7-2p64 No score

Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent...

Record: GHSA-fwv6-j4q7-2p64
Updated: 2026-11-02

OSV No score

Record: CVE-2006-4336
Updated: 2026-11-02

OSVDEBIAN-CVE-2006-4336 No score

Record: DEBIAN-CVE-2006-4336
Updated: 2026-11-02

Affected products

gzip

Affected packages

Affected packages
Package	Affected	Fixed
`gzip` Debian:12	before 1.3.5-15	1.3.5-15
`gzip` Debian:13	before 1.3.5-15	1.3.5-15
`gzip` Debian:14	before 1.3.5-15	1.3.5-15
`gzip` Debian:3.1	before 1.3.5-10sarge2, plus listed versions 1.3.5-101.3.5-10sarge1	1.3.5-10sarge2
`gzip` Red Hat:enterprise_linux:3::as	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3
`gzip-debuginfo` Red Hat:enterprise_linux:3::as	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3
`gzip` Red Hat:enterprise_linux:3::desktop	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3
`gzip-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3
`gzip` Red Hat:enterprise_linux:3::es	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3
`gzip-debuginfo` Red Hat:enterprise_linux:3::es	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`gzip` Red Hat:enterprise_linux:3::ws	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3
`gzip-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:1.3.3-13.rhel3	0:1.3.3-13.rhel3
`gzip` Red Hat:enterprise_linux:4::as	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4
`gzip-debuginfo` Red Hat:enterprise_linux:4::as	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4
`gzip` Red Hat:enterprise_linux:4::desktop	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4
`gzip-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4
`gzip` Red Hat:enterprise_linux:4::es	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4
`gzip-debuginfo` Red Hat:enterprise_linux:4::es	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4
`gzip` Red Hat:enterprise_linux:4::ws	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4
`gzip-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:1.3.3-16.rhel4	0:1.3.3-16.rhel4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-4336 is a high vulnerability (CVSS 7.5) in Gzip, published September 19, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.96%, the 93rd percentile. Fixed in gzip 1.3.5-15.

References

Show 74 moreShow less