FreeBSD : bzip2 -- denial of service and permission race vulnerabilities (197f444f-e8ef-11d9-b875-0001020eed82)

Problem Description Two problems have been discovered relating to the extraction of bzip2-compressed files. First, a carefully constructed invalid bzip2 archive can cause bzip2 to enter an infinite loop. Second, when creating a new file, bzip2 closes the file before setting its permissions. Impac...

Debian DSA-741-1 : bzip2 - infinite loop

Chris Evans discovered that a specially crafted archive can trigger an infinite loop in bzip2, a high-quality block-sorting file compressor. During uncompression this results in an indefinitely growing output file which will finally fill up the disk. On systems that automatically decompress bzip2...

[SECURITY] [DSA 741-1] New bzip2 packages prevent decompression bomb

-------------------------------------------------------------------------- Debian Security Advisory DSA 741-1 [email protected] http://www.debian.org/security/ Martin Schulze July 7th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 741-1] New bzip2 packages prevent decompression bomb

-------------------------------------------------------------------------- Debian Security Advisory DSA 741-1 [email protected] http://www.debian.org/security/ Martin Schulze July 7th, 2005 http://www.debian.org/security/faq -...

DSA-741-1 bzip2 - infinite loop

Bulletin has no description...

FreeBSD-SA-05:14.bzip2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:14.bzip2 Security Advisory The FreeBSD Project Topic: bzip2 denial of service and permission race vulnerabilities Category: contrib Module: contribbzip2...

Debian DSA-730-1 : bzip2 - race condition

Imran Ghory discovered a race condition in bzip2, a high-quality block-sorting file compressor and decompressor. When decompressing a file in a directory an attacker has access to, bunzip2 could be tricked to set the file permissions to a different file the user has permissions to. %NASLMINLEVEL...

RHEL 4 : bzip2 (RHSA-2005:474)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:474 advisory. Bzip2 is a data compressor. A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file wi...

bzip2 security update

CentOS Errata and Security Advisory CESA-2005:474-01 Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Updated 13 February 2006 Replacement bzip2 packages for Red Hat Enterprise Linux ...

bzip2 security update

CentOS Errata and Security Advisory CESA-2005:474 Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Updated 13 February 2006 Replacement bzip2 packages for Red Hat Enterprise Linux 4...

security flaw

Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete...

security flaw

bzip2 allows remote attackers to cause a denial of service hard drive consumption via a crafted bzip2 file that causes an infinite loop a.k.a "decompression bomb"...

Low: Red Hat Security Advisory: bzip2 security update

Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Updated 13 February 2006 Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages...

[SECURITY] [DSA 730-1] New bzip2 packages fix file unauthorised permissions modification

-------------------------------------------------------------------------- Debian Security Advisory DSA 730-1 [email protected] http://www.debian.org/security/ Martin Schulze May 27th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 730-1] New bzip2 packages fix file unauthorised permissions modification

-------------------------------------------------------------------------- Debian Security Advisory DSA 730-1 [email protected] http://www.debian.org/security/ Martin Schulze May 27th, 2005 http://www.debian.org/security/faq -...

DSA-730-1 bzip2 - race condition

Bulletin has no description...

CVE-2005-1260

bzip2 allows remote attackers to cause a denial of service hard drive consumption via a crafted bzip2 file that causes an infinite loop a.k.a "decompression bomb"...

CVE-2005-1260

bzip2 allows remote attackers to cause a denial of service hard drive consumption via a crafted bzip2 file that causes an infinite loop a.k.a "decompression bomb"...

CVE-2005-1260

bzip2 allows remote attackers to cause a denial of service hard drive consumption via a crafted bzip2 file that causes an infinite loop a.k.a "decompression bomb"...

CVE-2005-1260

CVE-2005-1260 describes a remote denial-of-service vulnerability in bzip2 where a crafted archive can cause an infinite loop during decompression, potentially exhausting disk space. Public documents show this issue alongside a related local race condition (CVE-2005-0953) and note that untrusted a...