Vulnerability Description
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bzip | Bzip2 | <= 1.0.6 |
| Debian | Debian Linux | 8.0 |
| Opensuse | Leap | 15.0 |
| Canonical | Ubuntu Linux | 12.04 |
| Freebsd | Freebsd | 11.2 |
| Python | Python | >= 3.7.0, < 3.7.13 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.htmlMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-UpThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SAThird Party AdvisoryVDB Entry
- https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71aPatchVendor Advisory
- https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60
- https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a162
- https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1f
- https://lists.debian.org/debian-lts-announce/2019/06/msg00021.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/07/msg00014.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00012.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00018.htmlMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Aug/4Mailing ListPatchThird Party Advisory
FAQ
What is CVE-2019-12900?
CVE-2019-12900 is a vulnerability with a CVSS score of 9.8 (CRITICAL). BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
How severe is CVE-2019-12900?
CVE-2019-12900 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-12900?
Check the references section above for vendor advisories and patch information. Affected products include: Bzip Bzip2, Debian Debian Linux, Opensuse Leap, Canonical Ubuntu Linux, Freebsd Freebsd.