National Cyber Awareness System

Vulnerability Summary for CVE-2010-0405

Overview

Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2231

Hyperlink:https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2231

External Source: CONFIRM

Name: https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2230

Hyperlink:https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2230

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=627882

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=627882

External Source: CONFIRM

Name: http://xorl.wordpress.com/2010/09/21/cve-2010-0405-bzip2-integer-overflow/

Hyperlink:http://xorl.wordpress.com/2010/09/21/cve-2010-0405-bzip2-integer-overflow/

External Source: VUPEN

Name: ADV-2010-3127

Hyperlink:http://www.vupen.com/english/advisories/2010/3127

External Source: VUPEN

Name: ADV-2010-3126

Hyperlink:http://www.vupen.com/english/advisories/2010/3126

External Source: VUPEN

Name: ADV-2010-3073

Hyperlink:http://www.vupen.com/english/advisories/2010/3073

External Source: VUPEN

Name: ADV-2010-3052

Hyperlink:http://www.vupen.com/english/advisories/2010/3052

External Source: VUPEN

Name: ADV-2010-3043

Hyperlink:http://www.vupen.com/english/advisories/2010/3043

External Source: VUPEN

Name: ADV-2010-2455

Hyperlink:http://www.vupen.com/english/advisories/2010/2455

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2010-0019.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2010-0019.html

External Source: UBUNTU

Name: USN-986-3

Hyperlink:http://www.ubuntu.com/usn/USN-986-3

External Source: UBUNTU

Name: USN-986-2

Hyperlink:http://www.ubuntu.com/usn/USN-986-2

External Source: UBUNTU

Name: USN-986-1

Hyperlink:http://www.ubuntu.com/usn/usn-986-1

External Source: BUGTRAQ

Name: 20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/515055/100/0/threaded

External Source: REDHAT

Name: RHSA-2010:0858

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0858.html

External Source: REDHAT

Name: RHSA-2010:0703

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0703.html

External Source: CONFIRM

Name: http://www.bzip.org/

Hyperlink:http://www.bzip.org/

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4581

Hyperlink:http://support.apple.com/kb/HT4581

External Source: SECUNIA

Name: 48378

Hyperlink:http://secunia.com/advisories/48378

External Source: SECUNIA

Name: 42530

Hyperlink:http://secunia.com/advisories/42530

External Source: SECUNIA

Name: 42529

Hyperlink:http://secunia.com/advisories/42529

External Source: SECUNIA

Name: 42405

Hyperlink:http://secunia.com/advisories/42405

External Source: SECUNIA

Name: 42404

Hyperlink:http://secunia.com/advisories/42404

External Source: SECUNIA

Name: 42350

Hyperlink:http://secunia.com/advisories/42350

External Source: SECUNIA

Name: 41505

Hyperlink:http://secunia.com/advisories/41505

External Source: SECUNIA

Name: 41452

Type: Advisory

Hyperlink:http://secunia.com/advisories/41452

External Source: MLIST

Name: [oss-security] 20100921 bzip2 CVE-2010-0405 integer overflow

Hyperlink:http://marc.info/?l=oss-security&m=128506868510655&w=2

External Source: SUSE

Name: SUSE-SR:2010:018

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html

External Source: FEDORA

Name: FEDORA-2010-1512

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051366.html

External Source: FEDORA

Name: FEDORA-2010-17439

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051278.html

External Source: APPLE

Name: APPLE-SA-2011-03-21-1

Hyperlink:http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

External Source: CONFIRM

Name: http://git.clamav.net/gitweb?p=clamav-devel.git;a=blob_plain;f=ChangeLog;hb=clamav-0.96.3

Hyperlink:http://git.clamav.net/gitweb?p=clamav-devel.git;a=blob_plain;f=ChangeLog;hb=clamav-0.96.3

External Source: CONFIRM

Name: http://blogs.sun.com/security/entry/cve_2010_0405_integer_overflow

Hyperlink:http://blogs.sun.com/security/entry/cve_2010_0405_integer_overflow