CVE-2010-0405
Fixed in a distro release EPSS 3%
Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | bzip2 | 1.0.5-6 |
| Debian 12 | clamav | 0.96.3+dfsg-1 |
| Debian 13 | bzip2 | 1.0.5-6 |
| Debian 13 | clamav | 0.96.3+dfsg-1 |
| Debian 14 | bzip2 | 1.0.5-6 |
| Debian 14 | clamav | 0.96.3+dfsg-1 |
| Debian 5.0 | bzip2 | 1.0.5-1+lenny1 |
| Red Hat Enterprise Linux 3 | bzip2 | 0:1.0.2-14.EL3 |
| Red Hat Enterprise Linux 3 | bzip2-debuginfo | 0:1.0.2-14.EL3 |
| Red Hat Enterprise Linux 3 | bzip2-devel | 0:1.0.2-14.EL3 |
| Red Hat Enterprise Linux 3 | bzip2-libs | 0:1.0.2-14.EL3 |
| Red Hat Enterprise Linux 4 | bzip2 | 0:1.0.2-16.el4_8 |
| Red Hat Enterprise Linux 4 | bzip2-debuginfo | 0:1.0.2-16.el4_8 |
| Red Hat Enterprise Linux 4 | bzip2-devel | 0:1.0.2-16.el4_8 |
| Red Hat Enterprise Linux 4 | bzip2-libs | 0:1.0.2-16.el4_8 |
| Red Hat Enterprise Linux 5 | bzip2 | 0:1.0.3-6.el5_5 |
| Red Hat Enterprise Linux 5 | bzip2-debuginfo | 0:1.0.3-6.el5_5 |
| Red Hat Enterprise Linux 5 | bzip2-devel | 0:1.0.3-6.el5_5 |
| Red Hat Enterprise Linux 5 | bzip2-libs | 0:1.0.3-6.el5_5 |
| Red Hat Enterprise Linux 6 | bzip2 | 0:1.0.5-7.el6_0 |
| Red Hat Enterprise Linux 6 | bzip2-debuginfo | 0:1.0.5-7.el6_0 |
| Red Hat Enterprise Linux 6 | bzip2-devel | 0:1.0.5-7.el6_0 |
| Red Hat Enterprise Linux 6 | bzip2-libs | 0:1.0.5-7.el6_0 |
| openSUSE Tumbleweed | bzip2 | 1.0.6-37.82 |
| openSUSE Tumbleweed | clamav | 0.99.2-4.1 |