CVE-2023-29420: Buffer Overflow
First published: Thu Apr 06 2023(Updated: )
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| bzip3 | <1.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/kspalaiologos/bzip3/commit/bb06deb85f1c249838eb938e0dab271d4194f8fa
- https://github.com/kspalaiologos/bzip3/compare/1.2.2...1.2.3
- https://github.com/kspalaiologos/bzip3/issues/92
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMLFV2FJK3CM7NJLVPZI5RUAFQZICPWW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMLFV2FJK3CM7NJLVPZI5RUAFQZICPWW/
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-29420.
What is the severity of CVE-2023-29420?
The severity of CVE-2023-29420 is medium, with a severity value of 6.5.
What is the affected software?
The affected software is Bzip3 Project Bzip3 version up to but not including 1.2.3.
What is the CWE number?
The CWE number for CVE-2023-29420 is 119.
Is there a fix available for CVE-2023-29420?
Yes, a fix is available. It can be found in the commit titled 'bb06deb85f1c249838eb938e0dab271d4194f8fa' in the bzip3 repository.
- agent/type
- agent/remedy
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/bzip3 project
- canonical/bzip3