Vulnerability Report

CVE-2008-1372

Title: Bzip Bzip2 Memory Corruption

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2008-1372.

CWE Category CWE-119
Published Date Mar 18, 2008
Modified Date Jun 16, 2026
Exploit Status Not Found
Score 4.3 CVSS v2.0
Exploit Probability (EPSS)
4.52%

Vulnerability Summary

CVE-2008-1372: bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

Impacted Vendors

B
bzip 1
B
bzip2_project 1

Reference Links

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-004.txt.asc http://kb.vmware.com/kb/1006982 http://kb.vmware.com/kb/1007198 http://kb.vmware.com/kb/1007504 http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html http://secunia.com/advisories/29410 http://secunia.com/advisories/29475 http://secunia.com/advisories/29497 http://secunia.com/advisories/29506 http://secunia.com/advisories/29656 http://secunia.com/advisories/29677 http://secunia.com/advisories/29698 http://secunia.com/advisories/29940 http://secunia.com/advisories/31204 http://secunia.com/advisories/31869 http://secunia.com/advisories/31878 http://secunia.com/advisories/36096 http://security.gentoo.org/glsa/glsa-200903-40.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-241786-1 http://support.apple.com/kb/HT3757 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0118 http://www.bzip.org/CHANGES http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/ http://www.gentoo.org/security/en/glsa/glsa-200804-02.xml http://www.ipcop.org/index.php?name=News&file=article&sid=40 http://www.kb.cert.org/vuls/id/813451 http://www.mandriva.com/security/advisories?name=MDVSA-2008:075 http://www.redhat.com/support/errata/RHSA-2008-0893.html http://www.securityfocus.com/archive/1/489968/100/0/threaded http://www.securityfocus.com/archive/1/498863/100/0/threaded http://www.securityfocus.com/bid/28286 http://www.securitytracker.com/id?1020867 http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473263 http://www.us-cert.gov/cas/techalerts/TA09-218A.html http://www.vupen.com/english/advisories/2008/0915 http://www.vupen.com/english/advisories/2008/2557 http://www.vupen.com/english/advisories/2009/2172 https://bugs.gentoo.org/attachment.cgi?id=146488&action=view https://exchange.xforce.ibmcloud.com/vulnerabilities/41249 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10067 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6467 https://usn.ubuntu.com/590-1/ https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00165.html https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00225.html ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-004.txt.asc http://kb.vmware.com/kb/1006982 http://kb.vmware.com/kb/1007198 http://kb.vmware.com/kb/1007504 http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html http://secunia.com/advisories/29410 http://secunia.com/advisories/29475 http://secunia.com/advisories/29497 http://secunia.com/advisories/29506 http://secunia.com/advisories/29656 http://secunia.com/advisories/29677 http://secunia.com/advisories/29698 http://secunia.com/advisories/29940 http://secunia.com/advisories/31204 http://secunia.com/advisories/31869 http://secunia.com/advisories/31878 http://secunia.com/advisories/36096 http://security.gentoo.org/glsa/glsa-200903-40.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-241786-1 http://support.apple.com/kb/HT3757 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0118 http://www.bzip.org/CHANGES http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/ http://www.gentoo.org/security/en/glsa/glsa-200804-02.xml http://www.ipcop.org/index.php?name=News&file=article&sid=40 http://www.kb.cert.org/vuls/id/813451 http://www.mandriva.com/security/advisories?name=MDVSA-2008:075 http://www.redhat.com/support/errata/RHSA-2008-0893.html http://www.securityfocus.com/archive/1/489968/100/0/threaded http://www.securityfocus.com/archive/1/498863/100/0/threaded http://www.securityfocus.com/bid/28286 http://www.securitytracker.com/id?1020867 http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473263 http://www.us-cert.gov/cas/techalerts/TA09-218A.html http://www.vupen.com/english/advisories/2008/0915 http://www.vupen.com/english/advisories/2008/2557 http://www.vupen.com/english/advisories/2009/2172 https://bugs.gentoo.org/attachment.cgi?id=146488&action=view https://exchange.xforce.ibmcloud.com/vulnerabilities/41249 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10067 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6467 https://usn.ubuntu.com/590-1/ https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00165.html https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00225.html
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
4.3
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2008-1372 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected Stack

No specific products linked.