What’s Vulnerable › Vulnerabilities
CVE-2019-12900
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 8.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-06-19 · updated 2026-10-14
- Weakness: CWE-787
Description
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Affected products
- Bzip2: through 1.0.6
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.04
- Debian Linux: 8.0
- FreeBSD: 11.2, 11.2-p10, 11.2-p11, 11.2-p12, 11.2-p2, 11.2-p3 (+18)
- openSUSE Leap: 15.0, 15.1
- Python: from 3.7.0 before 3.7.13; from 3.8.0 before 3.8.13; from 3.9.0 before 3.9.11; from 3.10.0 before 3.10.3 — fixed in 3.10.3, 3.7.13, 3.8.13, 3.9.11
How to fix
Upgrade to a fixed version: Python 3.10.3, 3.7.13, 3.8.13, 3.9.11. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
- https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
- https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html
- https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html
Get alerted when CVE-2019-12900 or the next vulnerability affects your stack