Upstream information

CVE-2008-1372 at MITRE

Description

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 4.3
Vector AV:N/AC:M/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
SUSE Bugzilla entry: 372047 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 11 SP1
  • bzip2 >= 1.0.5-34.246
  • bzip2-doc >= 1.0.5-34.246
  • libbz2-1 >= 1.0.5-34.246
  • libbz2-1-32bit >= 1.0.5-34.246
  • libbz2-1-x86 >= 1.0.5-34.246
SUSE Linux Enterprise Server 11 SP2
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Server 11 SP4
  • bzip2 >= 1.0.5-34.253.1
  • bzip2-doc >= 1.0.5-34.253.1
  • libbz2-1 >= 1.0.5-34.253.1
  • libbz2-1-32bit >= 1.0.5-34.253.1
  • libbz2-1-x86 >= 1.0.5-34.253.1
SUSE Linux Enterprise Software Development Kit 11 SP4
  • libbz2-devel >= 1.0.5-34.253.1
openSUSE Tumbleweed
  • bzip2 >= 1.0.8-3.2
  • bzip2-doc >= 1.0.8-3.2
  • libbz2-1 >= 1.0.8-3.2
  • libbz2-1-32bit >= 1.0.8-3.2
  • libbz2-devel >= 1.0.8-3.2
  • libbz2-devel-32bit >= 1.0.8-3.2
Patchnames:
openSUSE Tumbleweed GA bzip2-1.0.8-3.2