CVE-2008-1372

Published: Mar 18, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

Affected (12)

Products: Bzip: Bzip2

Bzip

1 product

Bzip2

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Bzip Bzip2	Version 0.9.5a
Bzip Bzip2	Version 0.9.5b
Bzip Bzip2	Version 0.9.5c
Bzip Bzip2	Version 0.9.5d
Bzip Bzip2	Version 0.9
Bzip Bzip2	Version 0.9_a
Bzip Bzip2	Version 0.9_b
Bzip Bzip2	Version 0.9_c
Bzip Bzip2	Version 1.0.1
Bzip Bzip2	Version 1.0.2
Bzip Bzip2	Version 1.0.3
Bzip Bzip2	Version 1.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (92)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-004.txt.asc (unsafe URL)

Source: cve@mitre.org

http://kb.vmware.com/kb/1006982

Source: cve@mitre.org

http://kb.vmware.com/kb/1007198

Source: cve@mitre.org

http://kb.vmware.com/kb/1007504

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html

Source: cve@mitre.org

http://secunia.com/advisories/29410

Source: cve@mitre.org

http://secunia.com/advisories/29475

Source: cve@mitre.org

http://secunia.com/advisories/29497

Source: cve@mitre.org

http://secunia.com/advisories/29506

Source: cve@mitre.org

http://secunia.com/advisories/29656

Source: cve@mitre.org

http://secunia.com/advisories/29677

Source: cve@mitre.org

http://secunia.com/advisories/29698

Source: cve@mitre.org

http://secunia.com/advisories/29940

Source: cve@mitre.org

http://secunia.com/advisories/31204

Source: cve@mitre.org

http://secunia.com/advisories/31869

Source: cve@mitre.org

http://secunia.com/advisories/31878

Source: cve@mitre.org

http://secunia.com/advisories/36096

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200903-40.xml

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-241786-1

Source: cve@mitre.org

http://support.apple.com/kb/HT3757

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0118

Source: cve@mitre.org

http://www.bzip.org/CHANGES

Source: cve@mitre.org

http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html

Source: cve@mitre.org

http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200804-02.xml

Source: cve@mitre.org

http://www.ipcop.org/index.php?name=News&file=article&sid=40

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/813451

Source: cve@mitre.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2008:075

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0893.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/489968/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/498863/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/28286

Source: cve@mitre.org

Exploit

http://www.securitytracker.com/id?1020867

Source: cve@mitre.org

http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473263

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-218A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2008/0915

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2557

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/2172

Source: cve@mitre.org

https://bugs.gentoo.org/attachment.cgi?id=146488&action=view

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/41249

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10067

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6467

Source: cve@mitre.org

https://usn.ubuntu.com/590-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00165.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00225.html

Source: cve@mitre.org

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-004.txt.asc (unsafe URL)