RHEL 6 : bzip2 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - bzip2: out-of-bounds write in function BZ2decompress CVE-2019-12900 - Use-after-free vulnerability in...

RHEL 7 : bzip2 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - bzip2: heap use after free in bzip2recover CVE-2016-3189 Note that Nessus has not tested for this issue but has...

CVE-2024-3508: Uncontrolled Resource Consumption

A flaw was found in Bombastic, which allows authenticated users to upload compressed bzip2 or zstd SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed...

Bombastic 安全漏洞

Bombastic is an Android system inventory manager and automated tester. A security vulnerability exists in Bombastic that originates from allowing authenticated users to upload compressed bzip2 or zstd...

[SECURITY] Fedora 39 Update: engrampa-1.26.2-1.fc39

Mate File Archiver is an application for creating and viewing archives files, such as zip, xv, bzip2, cab, rar and other compress formats...

Security Bulletin: Security vulnerabilities have been identified in bzip2 shipped with IBM License Metric Tool v9.

Summary There are two vulnerabilities in bzip2 shipped with IBM License Metric Tool. Those vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2016-3189 DESCRIPTION: Bzip2 is vulnerable to a denial of service, caused by a use-after-free error in the bzip2recover. By persuading a...

Rocky Linux 8 : Satellite 6.12 Release (Important) (RLSA-2022:8506)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8506 advisory. - The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data which affects the allocation size use...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

CVE-2023-39020

stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument...

Stanford CoreNlp 代码注入漏洞

Stanford CoreNlp is a suite of open source, natural language parsing tools written in Java by the Stanford Nlp Group team. A security vulnerability exists in Stanford CoreNlp stanford-parser v3.9.2 and earlier versions, which stems from a code injection vulnerability in the component...

F5 Networks BIG-IP : bzip2 vulnerability (K68713584)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K68713584 advisory. BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

Debian: Security Advisory (DSA-2112-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 37 : rust-sequoia-octopus-librnp / rust-sequoia-sop / rust-sequoia-sq (2023-c17427d18a)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-c17427d18a advisory. Rebuild for bzip2 0.4.4 CVE-2023-22895 / RUSTSEC-2023-0004. Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 36 : rust-sequoia-octopus-librnp / rust-sequoia-sop / rust-sequoia-sq (2023-7bd6fbb5fa)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-7bd6fbb5fa advisory. Rebuild for bzip2 0.4.4 CVE-2023-22895 / RUSTSEC-2023-0004. Tenable has extracted the preceding description block directly from the Fedora security advisory...

K16965: bzip2 vulnerabilities CVE-2005-0953 and CVE-2005-1260

Security Advisory Description CVE-2005-0953 Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete...

K45816067: bzip2 vulnerability CVE-2016-3189

Security Advisory Description Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service crash via a crafted bzip2 file, related to block ends set to before the start of the block. CVE-2016-3189 Impact There is no impact; F5 products are not...

K23985340: Spring Integration Zip vulnerability CVE-2018-1261

Security Advisory Description Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the...

K15878: bzip2 vulnerability CVE-2010-0405

Security Advisory Description Description Integer overflow in the BZ2decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted compressed file...

K9592: bzip2 vulnerability CVE-2008-1372

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...