PSF-2016-5: Use After Free

Published Jun 30, 2016

Updated

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

Affected Software

1 affected component

bzip2 bzip2recover=1.0.6

Event History

Jun 30, 2016

CVE Published

via OSV·05:59 PM

Data Sourced

via OSV·05:59 PM

DescriptionSeverity

Frequently Asked Questions

Which systems are exposed?

Systems using the bzip2recover utility in bzip2 1.0.6 are exposed when they process crafted bzip2 files.

What does an attacker need to cause an impact?

An attacker needs to provide a crafted bzip2 file with block ends set before the start of the block. Processing that file with bzip2recover can cause a crash.

Does the issue affect data confidentiality or integrity?

The supplied CVSS vector indicates no confidentiality or integrity impact. The impact is denial of service, with high availability impact.

PSF-2016-5: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to cause an impact?

Does the issue affect data confidentiality or integrity?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to cause an impact?

Does the issue affect data confidentiality or integrity?