VDB
HSEC-2024-0002
HSEC-2024-0002
PUBLISHED
CVSS 4 MEDIUM
out-of-bounds write when there are many bzip2 selectors
Risk Scores
CVSS v3.0
4
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hackage | bz2 | 0.1.0.0, 0.1.0.0, 1.0.0.1 |
| Hackage | bzlib-conduit | 0.2.1.3, 0.1.0.0, 0.1.0.0 |
| Hackage | bzlib | 0.4, 0.5.1.0, 0.5.0.5 |
Timeline
- Nov 14, 2025 CVE Published
- Nov 14, 2025 CVE Updated
References
- https://gnu.wildebeest.org/blog/mjw/2019/08/02/bzip2-and-the-cve-that-wasnt/ discussion
- http://scary.beasts.org/security/CESA-2008-005.html discussion
- https://access.redhat.com/security/cve/cve-2019-12900 advisory
- https://sourceware.org/git/?p=bzip2.git;a=commit;h=7ed62bfb46e87a9e878712603469440e6882b184 patch