← back
CVE-2019-12900

CVE-2019-12900

CVSS 9.8 CRITICALEPSS 8.0%CWE-787
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.htmlunverifiedcve_referencepacketstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.htmlhttp://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.htmlhttp://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.htmlhttps://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbchttps://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/06/msg00021.htmlhttps://lists.debian.org/debian-lts-announce/2019/07/msg00014.html