Upstream information

CVE-2008-1372 at MITRE

Description

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 4.3
Vector AV:N/AC:M/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
SUSE Bugzilla entry: 372047 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 11 SP1
  • bzip2 >= 1.0.5-34.246
  • bzip2-doc >= 1.0.5-34.246
  • libbz2-1 >= 1.0.5-34.246
  • libbz2-1-32bit >= 1.0.5-34.246
  • libbz2-1-x86 >= 1.0.5-34.246
Patchnames:
SUSE Linux Enterprise Server 11 SP1 GA bzip2
SUSE Linux Enterprise Server 11 SP2
  • bzip2 >= 1.0.5-34.253.1
  • bzip2-doc >= 1.0.5-34.253.1
  • libbz2-1 >= 1.0.5-34.253.1
  • libbz2-1-32bit >= 1.0.5-34.253.1
  • libbz2-1-x86 >= 1.0.5-34.253.1
Patchnames:
SUSE Linux Enterprise Server 11 SP2 GA bzip2
SUSE Linux Enterprise Server 11 SP3
  • bzip2 >= 1.0.5-34.253.1
  • bzip2-doc >= 1.0.5-34.253.1
  • libbz2-1 >= 1.0.5-34.253.1
  • libbz2-1-32bit >= 1.0.5-34.253.1
  • libbz2-1-x86 >= 1.0.5-34.253.1
Patchnames:
SUSE Linux Enterprise Server 11 SP3 GA bzip2
SUSE Linux Enterprise Server 11 SP4
  • bzip2 >= 1.0.5-34.253.1
  • bzip2-doc >= 1.0.5-34.253.1
  • libbz2-1 >= 1.0.5-34.253.1
  • libbz2-1-32bit >= 1.0.5-34.253.1
  • libbz2-1-x86 >= 1.0.5-34.253.1
Patchnames:
SUSE Linux Enterprise Server 11 SP4 GA bzip2
SUSE Linux Enterprise Software Development Kit 11 SP4
  • libbz2-devel >= 1.0.5-34.253.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 11 SP4 GA libbz2-devel
SUSE LINUX 10.1
  • bzip2 >= 1.0.3-17.9
  • bzip2-32bit >= 1.0.3-17.9
  • bzip2-64bit >= 1.0.3-17.9
Novell Linux Desktop 9 for x86
Open Enterprise Server
  • bzip2 >= 1.0.2-346.9
sles10.ia64
sles10.s390x
sles9-nlpos.x86
sles10.ppc
core9.ppc
sled10.x86-64
sles10.x86-64
sles9-nld.x86-64
core9.ia64
core9.s390x
sles9-nld.x86
sles9-oes.x86
sled10.x86
core9.x86-64
sles10.x86
core9.x86
core9.s390
ZYPP Patch Nr: 5114
Novell Linux Desktop 9 for x86_64
  • bzip2 >= 1.0.2-346.9
  • bzip2-32bit >= 9-200803201535
sles10.ia64
sles10.s390x
sles9-nlpos.x86
sles10.ppc
core9.ppc
sled10.x86-64
sles10.x86-64
sles9-nld.x86-64
core9.ia64
core9.s390x
sles9-nld.x86
sles9-oes.x86
sled10.x86
core9.x86-64
sles10.x86
core9.x86
core9.s390
ZYPP Patch Nr: 5114