An use-after-free vulnerability has been found in bzip2 that could allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/bzip2 | * | < 1.0.6-r8 | >= 1.0.6-r8 |
bzip2 is a high-quality data compressor used extensively by Gentoo Linux.
A use-after-free flaw was found in bzip2recover, leading to a null pointer dereference, or a write to a closed file descriptor. Please review the CVE identifier referenced below for details.
A remote attacker could entice a user to process a specially crafted bzip2 archive using bzip2recover, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All bzip2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/bzip2-1.0.6-r8"
An integer overflow vulnerability has been found in bzip2 and could result in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/bzip2 | * | < 1.0.6 | >= 1.0.6 |
bzip2 is a high-quality data compressor used extensively by Gentoo Linux.
An integer overflow vulnerability has been discovered in bzip2. Please review the CVE identifier referenced below for details.
A remote attacker could entice a user to open a specially crafted compressed file using bzip2, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition.
There is no known workaround at this time.
All bzip2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/bzip2-1.0.6"
A buffer overread vulnerability has been discovered in Bzip2.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/bzip2 | * | < 1.0.5 | >= 1.0.5 |
bzip2 is a free and open source lossless data compression program.
The Oulu University discovered that bzip2 does not properly check offsets provided by the bzip2 file, leading to a buffer overread.
Remote attackers can entice a user or automated system to open a specially crafted file that triggers a buffer overread, causing a Denial of Service. libbz2 and programs linking against it are also affected.
There is no known workaround at this time.
All bzip2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/bzip2-1.0.5"