Description
bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb").
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bzip2 | 1.0.2-7 | — |
| Debian 13 | bzip2 | 1.0.2-7 | — |
| Debian 12 | bzip2 | 1.0.2-7 | — |
| Debian 3.0 | bzip2 | 1.0.2-1.woody5 | DSA-741-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | bzip2 +2 | 1.0.2-13.EL4.3 | RHSA-2005:474 |
| RHEL 3 | bzip2 +2 | 1.0.2-11.EL3.4 | RHSA-2005:474 |
Advisories 2
- RHSA-2005:474 Red Hat Security Advisory: bzip2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-741-1 bzip2 - infinite loop Debian Security (DSA / DLA) · Mar 9, 2026
References
- FLSA:158801 vendor-advisory
- USN-127-1 vendor-advisory
- 13657 vdb-entry
- DSA-741 vendor-advisory
- 26444 vdb-entry
- 15447 third-party-advisory
- oval:org.mitre.oval:def:10700 vdb-entry signature
- 27274 third-party-advisory
- 200191 vendor-advisory
- oval:org.mitre.oval:def:749 vdb-entry signature
- APPLE-SA-2007-11-14 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307041
- ADV-2007-3525 vdb-entry
- ADV-2007-3868 vdb-entry
- 27643 third-party-advisory
- 19183 third-party-advisory
- RHSA-2005:474 vendor-advisory
- TA07-319A third-party-advisory
- 103118 vendor-advisory