CVE-2019-12900
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jun 19, 2019
- Updated
- Oct 14, 2026
- Reserved
- Jun 19, 2019
Description
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [debian-lts-announce] 20190624 [SECURITY] [DLA 1833-1] bzip2 security updatemailing-list
- USN-4038-2vendor-advisory
- USN-4038-1vendor-advisory
- 20190715 [slackware-security] bzip2 (SSA:2019-195-01)mailing-list
- [debian-lts-announce] 20190718 [SECURITY] [DLA 1833-2] bzip2 regression updatemailing-list
- openSUSE-SU-2019:1781vendor-advisory
- FreeBSD-SA-19:18vendor-advisory
- 20190806 FreeBSD Security Advisory FreeBSD-SA-19:18.bzip2mailing-list
- openSUSE-SU-2019:1918vendor-advisory
- USN-4146-1vendor-advisory
- USN-4146-2vendor-advisory
- [debian-lts-announce] 20191010 [SECURITY] [DLA 1953-1] clamav security updatemailing-list
- [debian-lts-announce] 20191014 [SECURITY] [DLA 1953-2] clamav regression updatemailing-list
- openSUSE-SU-2019:2595vendor-advisory
- openSUSE-SU-2019:2597vendor-advisory
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafkamailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
- https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
- https://support.f5.com/csp/article/K68713584?utm_source=f5support&%3Butm_medium=RSS
- [flink-user] 20210716 Flink 1.13.1 - Vulnerabilities CVE-2019-12900 for librocksdbjnimailing-list
- [flink-user] 20210717 Re: Flink 1.13.1 - Vulnerabilities CVE-2019-12900 for librocksdbjnimailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-202008.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.