K68713584 : bzip2 vulnerability CVE-2019-12900

Security Advisory Description

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. (CVE-2019-12900)

Impact

BIG-IP AAM

If an iSession tunnel is configured with an iSession profile that has bzip2 compression enabled, an attacker using specially crafted compressed files can exploit a vulnerability that exists in the decompress functionality of the bzip2 utility, causing an out-of-bounds write. For more information about out-of-bounds writes, refer to CWE-787: Out-of-bounds Write.

Note: This link takes you to a resource outside of AskF5, and the third party could remove the document without our knowledge.

BIG-IP, BIG-IQ, Enterprise Manager, iWorkflow, and Traffix SDC

A locally authenticated attacker, using specially crafted compressed files, can exploit a vulnerability that exists in the decompress functionality of the bzip2 utility, causing an out-of-bounds write. For more information about out-of-bounds writes, refer to CWE-787: Out-of-bounds Write.

Note: This link takes you to a resource outside of AskF5, and the third party could remove the document without our knowledge.