CVE-2016-3189

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-30 · updated 2026-10-14
Weakness: CWE-416

Description

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

Affected products

Bzip2: 1.0.6
Python: from 3.7.0 before 3.7.13; from 3.8.0 before 3.8.13; from 3.9.0 before 3.9.11; from 3.10.0 before 3.10.3 — fixed in 3.10.3, 3.7.13, 3.8.13, 3.9.11

How to fix

Upgrade to a fixed version: Python 3.10.3, 3.7.13, 3.8.13, 3.9.11. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
http://www.openwall.com/lists/oss-security/2016/06/20/1
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.securityfocus.com/bid/91297
http://www.securitytracker.com/id/1036132
https://bugzilla.redhat.com/show_bug.cgi?id=1319648
https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E

Get alerted when CVE-2016-3189 or the next vulnerability affects your stack