5.1 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
0.027 Low
EPSS
Percentile
90.4%
bzip2 is a high-quality data compressor used extensively by Gentoo Linux.
An integer overflow vulnerability has been discovered in bzip2. Please review the CVE identifier referenced below for details.
A remote attacker could entice a user to open a specially crafted compressed file using bzip2, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition.
There is no known workaround at this time.
All bzip2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-arch/bzip2-1.0.6"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | app-arch/bzip2 | < 1.0.6 | UNKNOWN |