Low ELSA-2024-8922 1 CVE

Low: bzip2 security update (Oracle Linux 8)

Published Nov 11, 2024 · Updated Nov 11, 2024

Ecosystem: Oracle Linux

Summary

[1.0.6-27.0.1]
- CVE-2019-12900: Accept as many selectors as the file format allows [Orabug: 37266061]

[1.0.6-27]
- Fixes out of bounds access in BZ2_decompress (RHEL-64929)

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 8	bzip2	0:1.0.6-27.0.1.el8_10
Oracle Linux · 8	bzip2-devel	0:1.0.6-27.0.1.el8_10
Oracle Linux · 8	bzip2-libs	0:1.0.6-27.0.1.el8_10

Vulnerabilities 1

Critical 9.8

CVE-2019-12900

out-of-bounds write when there are many bzip2 selectors

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

clamav clamav bzip2 bzip2 Debian Ubuntu Alpine Hackage

Jun 19, 2019