CVE-2023-22895

2023-01-1000:00:00

mitre

www.cve.org

bzip2 crate

denial of service

integer overflow

mem.rs

0.001 Low

EPSS

Percentile

50.6%

JSON

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

References

crates.io/crates/bzip2/versions

github.com/alexcrichton/bzip2-rs/pull/86

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MI5SVRSGKBWB2JGDLDVIFY5ZQVDZP6I7/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQK57GGXJX3AH7KF6S7S3N7JC5QOYUQ7/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUK2JO25PPA6XBREKJRBLRCD22LKIOLO/

0.001 Low

EPSS

Percentile

50.6%

JSON

Related for CVELIST:CVE-2023-22895