CVE-2008-1372: bzip bzip2

CVSS: 4.3v2.0MediumModified

AliasesRHSA-2008:0893DEBIAN-CVE-2008-1372

Published 18-03-2008Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2008-1372 is a medium (CVSS 4.3) vulnerability in bzip bzip2. EPSS estimates a 4.52% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

4.52%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10667-1

Timeline

18-03-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

4.52%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.52% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.52%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Redhat4 products

bzip2< 0:1.0.1-5.EL2.1 | < 0:1.0.2-12.EL3 | < 0:1.0.2-14.el4_7 | < 0:1.0.3-4.el5_2
bzip2-debuginfo< 0:1.0.2-12.EL3 | < 0:1.0.2-14.el4_7 | < 0:1.0.3-4.el5_2
bzip2-devel< 0:1.0.1-5.EL2.1 | < 0:1.0.2-12.EL3 | < 0:1.0.2-14.el4_7 | < 0:1.0.3-4.el5_2
bzip2-libs< 0:1.0.1-5.EL2.1 | < 0:1.0.2-12.EL3 | < 0:1.0.2-14.el4_7 | < 0:1.0.3-4.el5_2

Bzip1 product

bzip20.9 | 0.9.5a | 0.9.5b | 0.9.5c | 0.9.5d | 0.9_a | 0.9_b | 0.9_c | 1.0 | 1.0.1 | 1.0.2 | 1.0.3

Debian1 product

bzip2< 1.0.5-0.1

3 vendors · 6 products

References

53 links

support.apple.com/kb/HT3757X Refsource CONFIRM
exchange.xforce.ibmcloud.com/vulnerabilities/41249VDB EntryX Refsource XF
lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.htmlVendor AdvisoryX Refsource SUSE
www.bzip.org/CHANGESX Refsource CONFIRM
sunsolve.sun.com/search/document.do?assetkey=1-26-241786-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/36096Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-April/msg00165.htmlVendor AdvisoryX Refsource FEDORA
www.securityfocus.com/archive/1/498863/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2008/2557VDB EntryX Refsource VUPEN
secunia.com/advisories/31878Third Party AdvisoryX Refsource SECUNIA

Show all 53 references

www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473263Vendor AdvisoryX Refsource SLACKWARE
secunia.com/advisories/31869Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1020867VDB EntryX Refsource SECTRACK
www.redhat.com/support/errata/RHSA-2008-0893.htmlVendor AdvisoryX Refsource REDHAT
kb.vmware.com/kb/1007504X Refsource CONFIRM
www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.htmlX Refsource MISC
lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlVendor AdvisoryX Refsource APPLE
www.kb.cert.org/vuls/id/813451Third Party AdvisoryX Refsource CERT VNUS Government Resource
bugs.gentoo.org/attachment.cgi?id=146488&action=viewX Refsource CONFIRM
kb.vmware.com/kb/1007198X Refsource CONFIRM
www.gentoo.org/security/en/glsa/glsa-200804-02.xmlVendor AdvisoryX Refsource GENTOO
www.redhat.com/archives/fedora-package-announce/2008-April/msg00225.htmlVendor AdvisoryX Refsource FEDORA
kb.vmware.com/kb/1006982X Refsource CONFIRM
www.ipcop.org/index.php?name=News&file=article&sid=40X Refsource CONFIRM
secunia.com/advisories/29656Third Party AdvisoryX Refsource SECUNIA
wiki.rpath.com/wiki/Advisories:rPSA-2008-0118X Refsource CONFIRM
secunia.com/advisories/29475Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29698Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29497Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29940Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/489968/100/0/threadedMailing ListX Refsource BUGTRAQ
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6467VDB EntrySignatureX Refsource OVAL
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10067VDB EntrySignatureX Refsource OVAL
security.gentoo.org/glsa/glsa-200903-40.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/31204Third Party AdvisoryX Refsource SECUNIA
usn.ubuntu.com/590-1/Vendor AdvisoryX Refsource UBUNTU
www.mandriva.com/security/advisories?name=MDVSA-2008:075Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2008/0915VDB EntryX Refsource VUPEN
www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/X Refsource MISC
secunia.com/advisories/29506Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/2172VDB EntryX Refsource VUPEN
www.us-cert.gov/cas/techalerts/TA09-218A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.securityfocus.com/bid/28286VDB EntryX Refsource BIDExploit
secunia.com/advisories/29410Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29677Third Party AdvisoryX Refsource SECUNIA
access.redhat.com/errata/RHSA-2008:0893Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=438118REPORT
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0893.jsonAdvisory
access.redhat.com/security/cve/CVE-2008-1372REPORT
www.cve.org/CVERecord?id=CVE-2008-1372Advisory
nvd.nist.gov/vuln/detail/CVE-2008-1372Advisory
security-tracker.debian.org/tracker/CVE-2008-1372Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities