CVE-2023-29417: Medium severity bzip3 vulnerability

Published Apr 6, 2023

Updated

DISPUTED An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.

Affected Software

1 affected component

Bzip3 Project Bzip3=1.2.2

Remediation

Patch Available

https://github.com/kspalaiologos/bzip3/issues/97

Event History

Apr 6, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Disputed

05:15 AM

Data Sourced

via NVD·05:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-29417?

CVE-2023-29417 is a vulnerability found in libbzip3.a in bzip3 1.2.2, which can lead to an out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data.

What is the severity of CVE-2023-29417?

The severity of CVE-2023-29417 is medium with a severity value of 6.5.

Which software versions are affected by CVE-2023-29417?

CVE-2023-29417 affects bzip3 version 1.2.2.

How can I fix the vulnerability in CVE-2023-29417?

To fix the vulnerability in CVE-2023-29417, it is recommended to update to a patched version of bzip3 or apply the necessary security patches provided by the vendor.

What is CWE-125?

CWE-125 is a vulnerability that refers to an out-of-bounds read, which is relevant to the CVE-2023-29417 vulnerability.