Critical severity9.8NVD Advisory· Published Jun 19, 2019· Updated Jun 17, 2026
CVE-2019-12900
CVE-2019-12900
Description
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
63- bzip2/bzip2description
- osv-coords61 versionspkg:hackage/bz2pkg:hackage/bzlibpkg:hackage/bzlib-conduitpkg:rpm/almalinux/bzip2pkg:rpm/almalinux/bzip2-develpkg:rpm/almalinux/bzip2-libspkg:rpm/opensuse/bzip2&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/bzip2&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/bzip2&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/clamav&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/clamav&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/clamav&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/clamav&distro=openSUSE%20Tumbleweedpkg:rpm/suse/bzip2&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/bzip2&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/bzip2&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/bzip2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/bzip2&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/bzip2&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/bzip2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/clamav&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/clamav&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/clamav&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/clamav&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/clamav&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/clamav&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/clamav&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/clamav&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
>= 0.1.0.0, < 1.0.1.1+ 60 more
- (no CPE)range: >= 0.1.0.0, < 1.0.1.1
- (no CPE)range: >= 0.4, < 0.5.2.0
- (no CPE)range: >= 0.1.0.0, < 0.3.0.3
- (no CPE)range: < 1.0.6-27.el8_10
- (no CPE)range: < 1.0.6-27.el8_10
- (no CPE)range: < 1.0.6-27.el8_10
- (no CPE)range: < 1.0.6-lp151.5.6.1
- (no CPE)range: < 1.0.6-lp151.5.6.1
- (no CPE)range: < 1.0.8-3.2
- (no CPE)range: < 0.100.3-lp150.2.13.1
- (no CPE)range: < 0.100.3-lp151.2.3.1
- (no CPE)range: < 0.103.0-lp152.6.3.1
- (no CPE)range: < 0.103.3-1.4
- (no CPE)range: < 1.0.6-30.8.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-5.6.1
- (no CPE)range: < 1.0.6-5.6.1
- (no CPE)range: < 1.0.5-34.256.5.1
- (no CPE)range: < 1.0.5-34.256.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.8.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.5.1
- (no CPE)range: < 1.0.6-30.8.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-3.14.1
- (no CPE)range: < 0.100.3-3.14.1
- (no CPE)range: < 0.103.0-3.23.1
- (no CPE)range: < 0.100.3-0.20.26.1
- (no CPE)range: < 0.100.3-0.20.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.103.0-33.32.1
- (no CPE)range: < 0.103.0-3.3.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.103.0-3.3.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.103.0-33.32.1
- (no CPE)range: < 0.100.3-33.26.1
- (no CPE)range: < 0.103.0-33.32.1
Patches
Vulnerability mechanics
References
23- gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbcnvdPatchVendor Advisory
- seclists.org/bugtraq/2019/Aug/4nvdMailing ListPatchThird Party Advisory
- security.freebsd.org/advisories/FreeBSD-SA-19:18.bzip2.ascnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2020.htmlnvdPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.htmlnvdMailing ListThird Party Advisory
- packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.htmlnvdThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.htmlnvdThird Party AdvisoryVDB Entry
- lists.debian.org/debian-lts-announce/2019/06/msg00021.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/07/msg00014.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/10/msg00012.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/10/msg00018.htmlnvdMailing ListThird Party Advisory
- seclists.org/bugtraq/2019/Jul/22nvdMailing ListThird Party Advisory
- usn.ubuntu.com/4038-1/nvdThird Party Advisory
- usn.ubuntu.com/4038-2/nvdThird Party Advisory
- usn.ubuntu.com/4146-1/nvdThird Party Advisory
- usn.ubuntu.com/4146-2/nvdThird Party Advisory
- lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3Envd
- lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3Envd
- lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3Envd
- support.f5.com/csp/article/K68713584nvd
News mentions
0No linked articles in our index yet.