Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2008-1372

Published: 18/03/2008 Updated: 11/10/2018
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 385
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Subscribe to Bzip2

Vulnerability Summary

bzlib.c in bzip2 prior to 1.0.5 allows user-assisted remote malicious users to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

Vulnerable Product Search on Vulmon Subscribe to Product

bzip bzip2 0.9

bzip bzip2 0.9.5a

bzip bzip2 1.0

bzip bzip2 1.0.1

bzip bzip2 1.0.2

bzip bzip2 0.9_b

bzip bzip2 0.9_c

bzip bzip2 0.9.5d

bzip bzip2 0.9_a

bzip bzip2 0.9.5b

bzip bzip2 0.9.5c

bzip bzip2 1.0.3

Vendor Advisories

Red Hat: Moderate: bzip2 security update
Synopsis Moderate: bzip2 security update Type/Severity Security Advisory: Moderate Topic Updated bzip2 packages that fix a security issue are now available for RedHat Enterprise Linux 21, 3, 4, and 5This update has been rated as having moderate security impact by the RedHat Security Response Team ...
Debian CVElist Bug Report Logs: bzip2: CVE-2008-1372 buffer over-read via crafted archive file
Debian Bug report logs - #471670 bzip2: CVE-2008-1372 buffer over-read via crafted archive file Package: bzip2; Maintainer for bzip2 is Anibal Monsalve Salazar <anibal@debianorg>; Source for bzip2 is src:bzip2 (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: Wed, 19 Mar 2008 13:30:01 UTC Severi ...
Ubuntu Security Notice: bzip2 vulnerability
It was discovered that bzip2 did not correctly handle certain malformed archives If a user or automated system were tricked into processing a specially crafted bzip2 archive, applications linked against libbz2 could be made to crash, possibly leading to a denial of service ...

References

CWE-119http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.htmlhttps://bugs.gentoo.org/attachment.cgi?id=146488&action=viewhttp://www.kb.cert.org/vuls/id/813451http://www.securityfocus.com/bid/28286http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/http://www.bzip.org/CHANGEShttp://www.mandriva.com/security/advisories?name=MDVSA-2008:075http://secunia.com/advisories/29475http://secunia.com/advisories/29410http://secunia.com/advisories/29506http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473263http://secunia.com/advisories/29677https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00165.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-April/msg00225.htmlhttp://secunia.com/advisories/29698http://www.gentoo.org/security/en/glsa/glsa-200804-02.xmlhttp://secunia.com/advisories/29656ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-004.txt.aschttp://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.htmlhttp://secunia.com/advisories/29940http://secunia.com/advisories/31204http://www.ipcop.org/index.php?name=News&file=article&sid=40http://secunia.com/advisories/31869http://www.redhat.com/support/errata/RHSA-2008-0893.htmlhttp://secunia.com/advisories/31878http://sunsolve.sun.com/search/document.do?assetkey=1-26-241786-1http://www.securitytracker.com/id?1020867http://kb.vmware.com/kb/1007504http://kb.vmware.com/kb/1006982http://kb.vmware.com/kb/1007198http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0118http://security.gentoo.org/glsa/glsa-200903-40.xmlhttp://secunia.com/advisories/29497http://support.apple.com/kb/HT3757http://secunia.com/advisories/36096http://www.vupen.com/english/advisories/2009/2172http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-218A.htmlhttp://www.vupen.com/english/advisories/2008/0915http://www.vupen.com/english/advisories/2008/2557https://exchange.xforce.ibmcloud.com/vulnerabilities/41249https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6467https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10067https://usn.ubuntu.com/590-1/http://www.securityfocus.com/archive/1/498863/100/0/threadedhttp://www.securityfocus.com/archive/1/489968/100/0/threadedhttps://access.redhat.com/errata/RHSA-2008:0893https://usn.ubuntu.com/590-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-38298CVE-2024-20356CVE-2023-21987CVE-2024-33217bypassCVE-2024-31804CVE-2024-32660unauthorizedSSRF
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook