Fluid Attacks Database

Description

Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	bzip2	>=0 <1.0.5-6	1.0.5-6
debian 14	bzip2	>=0 <1.0.5-6	1.0.5-6
debian 12	bzip2	>=0 <1.0.5-6	1.0.5-6
debian 14	clamav	>=0 <0.96.3+dfsg-1	0.96.3+dfsg-1
debian 13	clamav	>=0 <0.96.3+dfsg-1	0.96.3+dfsg-1
debian 12	clamav	>=0 <0.96.3+dfsg-1	0.96.3+dfsg-1
rpm rhel5	bzip2	<0:1.0.3-6.el5_5	0:1.0.3-6.el5_5
rpm rhel6	bzip2	<0:1.0.5-7.el6_0	0:1.0.5-7.el6_0

Aliases

1. CVE-2010-04052. NVD-2010-04053. OSV-DEBIAN-2010-04054. OSV-2010-04055. SECURITY-TRACKER-CVE-2010-0405

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.