Vulnerability · Published Apr 6, 2023 · Assigned by mitre
CVE-2023-29417
Medium 6.5
In plain English
A medium-severity security flaw in the bzip3 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.8%top 43.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | bzip3 | no fix listed | DEBIAN-CVE-2023-29417 |
| Debian:13 | bzip3 | no fix listed | DEBIAN-CVE-2023-29417 |
| Debian:14 | bzip3 | no fix listed | DEBIAN-CVE-2023-29417 |
Affected products (as reported)
References
- https://github.com/kspalaiologos/bzip3/issues/97
- FEDORA-2023-3a821e6e73 vendor-advisory
- FEDORA-2023-c08f9dfc16 vendor-advisory
- FEDORA-2023-3589ad1c55 vendor-advisory