9.8

CVE-2019-12900: bzip bzip2 Out-of-bounds Write

CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2019-12900MGASA-2019-0338SUSE-SU-2019:14139-1
Published 19-06-2019Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2019-12900 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in bzip bzip2. EPSS estimates a 7.98% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
7.98%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 20
DLA-1833-1DLA-1953-1MGASA-2019-0328OPENSUSE-SU-2019:2595-1OPENSUSE-SU-2019:2597-1OPENSUSE-SU-2020:2268-1

Timeline

  1. 19-06-2019
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

CVSS metrics

8 scores · 6 sources · 3 versions

EPSS trend

Probability

7.98%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 7.98% on 18-09-2026

18-09-202618-10-2026
EPSS score
7.98%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse22 products
  • bzip2&distro=HPE Helion OpenStack 8< 1.0.6-30.8.1
  • bzip2&distro=SUSE Enterprise Storage 4< 1.0.6-30.8.1
  • bzip2&distro=SUSE Enterprise Storage 5< 1.0.6-30.8.1
  • bzip2&distro=SUSE Linux Enterprise Desktop 12 SP4< 1.0.6-30.8.1
  • bzip2&distro=SUSE Linux Enterprise Module for Basesystem 15< 1.0.6-5.6.1 | < 1.0.6-5.9.1
Redhat6 products
  • bzip2< 0:1.0.8-8.el9_4.1 | < 0:1.0.6-27.el8_10 | < 0:1.0.6-28.el8_10 | < 0:1.0.8-10.el9_5
  • bzip2-debuginfo< 0:1.0.8-8.el9_4.1 | < 0:1.0.6-27.el8_10 | < 0:1.0.6-28.el8_10 | < 0:1.0.8-10.el9_5
  • bzip2-debugsource< 0:1.0.8-8.el9_4.1 | < 0:1.0.6-27.el8_10 | < 0:1.0.6-28.el8_10 | < 0:1.0.8-10.el9_5
  • bzip2-devel< 0:1.0.8-8.el9_4.1 | < 0:1.0.6-27.el8_10 | < 0:1.0.6-28.el8_10 | < 0:1.0.8-10.el9_5
  • bzip2-libs< 0:1.0.8-8.el9_4.1 | < 0:1.0.6-27.el8_10 | < 0:1.0.6-28.el8_10 | < 0:1.0.8-10.el9_5
Debian3 products
Opensuse3 products
  • leapEOL15.0 | 15.1
  • bzip2&distro=openSUSE Leap 15.0< 1.0.6-lp151.5.6.1 | < 1.0.6-lp151.5.9.1
  • bzip2&distro=openSUSE Leap 15.1< 1.0.6-lp151.5.6.1 | < 1.0.6-lp151.5.9.1
Ubuntu2 products
  • bzip2< 1.0.6-5ubuntu0.1~esm2 | < 1.0.6-8ubuntu0.1 | < 1.0.6-8.1ubuntu0.1
  • clamav< 0.101.4+dfsg-0ubuntu0.14.04.1+esm1 | < 0.101.4+dfsg-0ubuntu0.16.04.1 | < 0.101.4+dfsg-0ubuntu0.18.04.1
Alpine1 product
  • bzip2< 1.0.6-r7
Bzip1 product
Canonical1 product
Freebsd1 product
  • freebsdEOL11.2 | 11.2:p10 | 11.2:p11 | 11.2:p12 | 11.2:p2 | 11.2:p3 | 11.2:p4 | 11.2:p5 | 11.2:p6 | 11.2:p7 | 11.2:p8 | 11.2:p9 | 11.2:rc3 | 11.3 | 11.3:p1 | 12.0 | 12.0:p1 | 12.0:p2 | 12.0:p3 | 12.0:p4 | 12.0:p5 | 12.0:p6 | 12.0:p7 | 12.0:p8
Mageia1 product
  • bzip2< 1.0.8-1.mga7
Python1 product
  • python≥ 3.7.0, < 3.7.13 | ≥ 3.8.0, < 3.8.13 | ≥ 3.9.0, < 3.9.11 | ≥ 3.10.0, < 3.10.3

11 vendors · 42 products

References

67 links
Show all 67 references