CVE-2008-1372

NameCVE-2008-1372
Descriptionbzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs471670

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bzip2 (PTS)bullseye1.0.8-4fixed
bookworm1.0.8-5fixed
sid, trixie1.0.8-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bzip2source(unstable)1.0.5-0.1low471670

Notes

[etch] - bzip2 <no-dsa> (Pure crasher, no code injection, mostly a regular bug)

Search for package or bug name: Reporting problems