CVE-2019-12900

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
VendorProductVersion
bzipbzip2
𝑥
≤ 1.0.6
debiandebian_linux
8.0
opensuseleap
15.0
opensuseleap
15.1
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
19.04
freebsdfreebsd
11.2
freebsdfreebsd
11.2:p10
freebsdfreebsd
11.2:p11
freebsdfreebsd
11.2:p12
freebsdfreebsd
11.2:p2
freebsdfreebsd
11.2:p3
freebsdfreebsd
11.2:p4
freebsdfreebsd
11.2:p5
freebsdfreebsd
11.2:p6
freebsdfreebsd
11.2:p7
freebsdfreebsd
11.2:p8
freebsdfreebsd
11.2:p9
freebsdfreebsd
11.2:rc3
freebsdfreebsd
11.3
freebsdfreebsd
11.3:p1
freebsdfreebsd
12.0
freebsdfreebsd
12.0:p1
freebsdfreebsd
12.0:p2
freebsdfreebsd
12.0:p3
freebsdfreebsd
12.0:p4
freebsdfreebsd
12.0:p5
freebsdfreebsd
12.0:p6
freebsdfreebsd
12.0:p7
freebsdfreebsd
12.0:p8
pythonpython
3.7.0 ≤
𝑥
< 3.7.13
pythonpython
3.8.0 ≤
𝑥
< 3.8.13
pythonpython
3.9.0 ≤
𝑥
< 3.9.11
pythonpython
3.10.0 ≤
𝑥
< 3.10.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
bzip2
bullseye
1.0.8-4
fixed
stretch
no-dsa
bookworm
1.0.8-5
fixed
sid
1.0.8-6
fixed
trixie
1.0.8-6
fixed
clamav
bullseye
0.103.10+dfsg-0+deb11u1
fixed
stretch
no-dsa
bookworm
1.0.5+dfsg-1~deb12u1
fixed
sid
1.4.1+dfsg-1
fixed
trixie
1.4.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bzip2
disco
Fixed 1.0.6-9ubuntu0.19.04.1
released
cosmic
Fixed 1.0.6-9ubuntu0.18.10.1
released
bionic
Fixed 1.0.6-8.1ubuntu0.2
released
xenial
Fixed 1.0.6-8ubuntu0.2
released
trusty
Fixed 1.0.6-5ubuntu0.1~esm2
released
clamav
disco
Fixed 0.101.4+dfsg-0ubuntu0.19.04.1
released
bionic
Fixed 0.101.4+dfsg-0ubuntu0.18.04.1
released
xenial
Fixed 0.101.4+dfsg-0ubuntu0.16.04.1
released
trusty
Fixed 0.101.4+dfsg-0ubuntu0.14.04.1+esm1
released
References