Security Bulletin: Security vulnerabilities have been identified in bzip2 shipped with IBM License Metric Tool v9.

Summary There are two vulnerabilities in bzip2 shipped with IBM License Metric Tool. Those vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2016-3189 DESCRIPTION: Bzip2 is vulnerable to a denial of service, caused by a use-after-free error in the bzip2recover. By persuading a...

Rocky Linux 8 : Satellite 6.12 Release (Important) (RLSA-2022:8506)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8506 advisory. - The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data which affects the allocation size use...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

CVE-2023-39020

stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument...

Stanford CoreNlp 代码注入漏洞

Stanford CoreNlp is a suite of open source, natural language parsing tools written in Java by the Stanford Nlp Group team. A security vulnerability exists in Stanford CoreNlp stanford-parser v3.9.2 and earlier versions, which stems from a code injection vulnerability in the component...

F5 Networks BIG-IP : bzip2 vulnerability (K68713584)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K68713584 advisory. BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

Debian: Security Advisory (DSA-2112-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 37 : rust-sequoia-octopus-librnp / rust-sequoia-sop / rust-sequoia-sq (2023-c17427d18a)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-c17427d18a advisory. Rebuild for bzip2 0.4.4 CVE-2023-22895 / RUSTSEC-2023-0004. Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 36 : rust-sequoia-octopus-librnp / rust-sequoia-sop / rust-sequoia-sq (2023-7bd6fbb5fa)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-7bd6fbb5fa advisory. Rebuild for bzip2 0.4.4 CVE-2023-22895 / RUSTSEC-2023-0004. Tenable has extracted the preceding description block directly from the Fedora security advisory...

K16965: bzip2 vulnerabilities CVE-2005-0953 and CVE-2005-1260

Security Advisory Description CVE-2005-0953 Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete...

K45816067: bzip2 vulnerability CVE-2016-3189

Security Advisory Description Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service crash via a crafted bzip2 file, related to block ends set to before the start of the block. CVE-2016-3189 Impact There is no impact; F5 products are not...

K23985340: Spring Integration Zip vulnerability CVE-2018-1261

Security Advisory Description Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the...

K15878: bzip2 vulnerability CVE-2010-0405

Security Advisory Description Description Integer overflow in the BZ2decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted compressed file...

K9592: bzip2 vulnerability CVE-2008-1372

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

SUSE CVE-2005-0953

Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete...

SUSE CVE-2005-1260

bzip2 allows remote attackers to cause a denial of service hard drive consumption via a crafted bzip2 file that causes an infinite loop a.k.a "decompression bomb"...

SUSE CVE-2007-1461

The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or openbasedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories...

SUSE CVE-2007-6337

Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlibprivate.h in ClamAV before 0.92 has unknown impact and remote attack vectors...

SUSE CVE-2008-1372

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service crash via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats...