Vulnerability Report

CVE-2010-0405

Title: Libzip2 RCE

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2010-0405.

CWE Category CWE-189

Published Date Sep 28, 2010

Modified Date Jun 16, 2026

Exploit Status Not Found

Score 5.1 CVSS v2.0

Exploit Probability (EPSS)

3.30%

Vulnerability Summary

CVE-2010-0405: Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

Impacted Vendors

bzip 1

libzip2 1

bzip2_project 1

Reference Links

http://blogs.sun.com/security/entry/cve_2010_0405_integer_overflow http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96.3 http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051278.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051366.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://marc.info/?l=oss-security&m=128506868510655&w=2 http://secunia.com/advisories/41452 http://secunia.com/advisories/41505 http://secunia.com/advisories/42350 http://secunia.com/advisories/42404 http://secunia.com/advisories/42405 http://secunia.com/advisories/42529 http://secunia.com/advisories/42530 http://secunia.com/advisories/48378 http://security.gentoo.org/glsa/glsa-201301-05.xml http://support.apple.com/kb/HT4581 http://www.bzip.org/ http://www.redhat.com/support/errata/RHSA-2010-0703.html http://www.redhat.com/support/errata/RHSA-2010-0858.html http://www.securityfocus.com/archive/1/515055/100/0/threaded http://www.ubuntu.com/usn/USN-986-2 http://www.ubuntu.com/usn/USN-986-3 http://www.ubuntu.com/usn/usn-986-1 http://www.vmware.com/security/advisories/VMSA-2010-0019.html http://www.vupen.com/english/advisories/2010/2455 http://www.vupen.com/english/advisories/2010/3043 http://www.vupen.com/english/advisories/2010/3052 http://www.vupen.com/english/advisories/2010/3073 http://www.vupen.com/english/advisories/2010/3126 http://www.vupen.com/english/advisories/2010/3127 http://xorl.wordpress.com/2010/09/21/cve-2010-0405-bzip2-integer-overflow/ https://bugzilla.redhat.com/show_bug.cgi?id=627882 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2230 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2231 http://blogs.sun.com/security/entry/cve_2010_0405_integer_overflow http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96.3 http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051278.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051366.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://marc.info/?l=oss-security&m=128506868510655&w=2 http://secunia.com/advisories/41452 http://secunia.com/advisories/41505 http://secunia.com/advisories/42350 http://secunia.com/advisories/42404 http://secunia.com/advisories/42405 http://secunia.com/advisories/42529 http://secunia.com/advisories/42530 http://secunia.com/advisories/48378 http://security.gentoo.org/glsa/glsa-201301-05.xml http://support.apple.com/kb/HT4581 http://www.bzip.org/ http://www.redhat.com/support/errata/RHSA-2010-0703.html http://www.redhat.com/support/errata/RHSA-2010-0858.html http://www.securityfocus.com/archive/1/515055/100/0/threaded http://www.ubuntu.com/usn/USN-986-2 http://www.ubuntu.com/usn/USN-986-3 http://www.ubuntu.com/usn/usn-986-1 http://www.vmware.com/security/advisories/VMSA-2010-0019.html http://www.vupen.com/english/advisories/2010/2455 http://www.vupen.com/english/advisories/2010/3043 http://www.vupen.com/english/advisories/2010/3052 http://www.vupen.com/english/advisories/2010/3073 http://www.vupen.com/english/advisories/2010/3126 http://www.vupen.com/english/advisories/2010/3127 http://xorl.wordpress.com/2010/09/21/cve-2010-0405-bzip2-integer-overflow/ https://bugzilla.redhat.com/show_bug.cgi?id=627882 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2230 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2231

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.1

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:H/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2010-0405 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 29, 2026 MODIFIED

Vulnerability data updated via NVD.

April 11, 2025 MODIFIED

Vulnerability data or affected products updated.

September 28, 2010 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.