Description
An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bzip3 | No fix yet | — |
| Debian 13 | bzip3 | No fix yet | — |
| Debian 12 | bzip3 | No fix yet | — |
Advisories 1
- WID-SEC-2023-0913 bzip3: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Apr 10, 2023
References
- https://github.com/kspalaiologos/bzip3/issues/97
- FEDORA-2023-3a821e6e73 vendor-advisory
- FEDORA-2023-c08f9dfc16 vendor-advisory
- FEDORA-2023-3589ad1c55 vendor-advisory