CVE-2016-3189: bzip bzip2 Use After Free
CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2016-3189MGASA-2016-0400SUSE-SU-2019:1206-1SUSE-SU-2019:1206-2UBUNTU-CVE-2016-3189DEBIAN-CVE-2016-3189openSUSE-SU-2019:1398-1openSUSE-SU-2019:1435-1
Published 30-06-2016Last modified 14-10-2026
Vulnerability summary
CVE-2016-3189 is a medium (CVSS 6.5) Use After Free vulnerability in bzip bzip2. EPSS estimates a 15.56% chance of exploitation in the next 30 days, higher than 96.8% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
15.56%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 30-06-2016PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
CVSS metrics
7 scores · 5 sources · 3 versionsMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 5 agree
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 6.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesSingle source
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
15.56%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 15.56% on 19-09-2026
19-09-202619-10-2026
EPSS score15.56%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Opensuse2 products
- bzip2&distro=openSUSE Leap 15.0< 1.0.6-lp150.4.3.1
- bzip2&distro=openSUSE Leap 15.1< 1.0.6-lp151.5.3.1
Suse2 products
- bzip2&distro=SUSE Linux Enterprise Module for Basesystem 15< 1.0.6-5.3.1
- bzip2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 1.0.6-5.3.1
Alpine1 product
- bzip2< 1.0.6-r5
Bzip1 product
- bzip21.0.6
Debian1 product
- bzip2< 1.0.6-8.1
Mageia1 product
- bzip2< 1.0.6-7.1.mga5
Python1 product
- python≥ 3.7.0, < 3.7.13 | ≥ 3.8.0, < 3.8.13 | ≥ 3.9.0, < 3.9.11 | ≥ 3.10.0, < 3.10.3
Ubuntu1 product
- bzip2< 1.0.6-5ubuntu0.1~esm1 | < 1.0.6-8ubuntu0.1
8 vendors · 10 products
References
43 links
lists.debian.org/debian-lts-announce/2019/06/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory- security.freebsd.org/advisories/FreeBSD-SA-19:18.bzip2.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
Show all 43 references
- www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1319648X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
- packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- bugzilla.suse.com/985657REPORT
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
