Description
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bzip3 | 1.2.2-2 | — |
| Debian 13 | bzip3 | 1.2.2-2 | — |
| Debian 12 | bzip3 | 1.2.2-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | bzip3 | No fix yet | — |
Advisories 1
- WID-SEC-2023-0913 bzip3: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Apr 10, 2023
References
- https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3
- https://github.com/kspalaiologos/bzip3/issues/94
- FEDORA-2023-3a821e6e73 vendor-advisory
- FEDORA-2023-c08f9dfc16 vendor-advisory
- FEDORA-2023-3589ad1c55 vendor-advisory