JVN#78689801: BGA32.DLL and QBga32.DLL contain multiple vulnerabilities

BGA32.DLL is a compression/decompression library for gza and bza-format files. BGA32.DLL contains multiple vulnerabilities (including a buffer overflow) because it utilizes vulnerable zlib and bzip2 libraries.
QBga32.DLL, which is a wrapper of BGA32.DLL, is also affected.

Impact

Decompressing a specially crafted file may result in denial-of-service (DoS) or arbitrary code execution.

Solution

Use the latest version of QBga32.DLL
These vulnerabilities have been addressed in QBga32.DLL version 0.05.

Do not use BGA32.DLL
BGA32.DLL is no longer being developed or maintained. It is recommended to stop using BGA32.DLL.

Products Affected

• BGA32.DLL
• QBga32.DLL version 0.04 and earlier