CVE-2010-0405

2010-09-2000:00:00

ubuntu.com

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.027 Low

EPSS

Percentile

90.4%

JSON

Integer overflow in the BZ2_decompress function in decompress.c in bzip2
and libbzip2 before 1.0.6 allows context-dependent attackers to cause a
denial of service (application crash) or possibly execute arbitrary code
via a crafted compressed file.

Notes

Author	Note
jdstrand	dump and dpkg use a statically linked bzip2 so simply need to be recompiled

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchbzip2< 1.0.3-0ubuntu2.2UNKNOWN
ubuntu8.04noarchbzip2< 1.0.4-2ubuntu4.1UNKNOWN
ubuntu9.04noarchbzip2< 1.0.5-1ubuntu1.1UNKNOWN
ubuntu9.10noarchbzip2< 1.0.5-3ubuntu0.1UNKNOWN
ubuntu10.04noarchbzip2< 1.0.5-4ubuntu0.1UNKNOWN
ubuntu6.06noarchclamav< 0.95.3+dfsg-1ubuntu0.09.04~dapper4.1UNKNOWN
ubuntu8.04noarchclamav< 0.95.3+dfsg-1ubuntu0.09.04~hardy2.5UNKNOWN
ubuntu9.04noarchclamav< 0.95.3+dfsg-1ubuntu0.09.04.3UNKNOWN
ubuntu9.10noarchclamav< 0.95.3+dfsg-1ubuntu0.09.10.3UNKNOWN
ubuntu10.04noarchclamav< 0.96.1+dfsg-0ubuntu0.10.04.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	bzip2	< 1.0.3-0ubuntu2.2	UNKNOWN
ubuntu	8.04	noarch	bzip2	< 1.0.4-2ubuntu4.1	UNKNOWN
ubuntu	9.04	noarch	bzip2	< 1.0.5-1ubuntu1.1	UNKNOWN
ubuntu	9.10	noarch	bzip2	< 1.0.5-3ubuntu0.1	UNKNOWN
ubuntu	10.04	noarch	bzip2	< 1.0.5-4ubuntu0.1	UNKNOWN
ubuntu	6.06	noarch	clamav	< 0.95.3+dfsg-1ubuntu0.09.04~dapper4.1	UNKNOWN
ubuntu	8.04	noarch	clamav	< 0.95.3+dfsg-1ubuntu0.09.04~hardy2.5	UNKNOWN
ubuntu	9.04	noarch	clamav	< 0.95.3+dfsg-1ubuntu0.09.04.3	UNKNOWN
ubuntu	9.10	noarch	clamav	< 0.95.3+dfsg-1ubuntu0.09.10.3	UNKNOWN
ubuntu	10.04	noarch	clamav	< 0.96.1+dfsg-0ubuntu0.10.04.2	UNKNOWN