PT-2023-22245 · Bzip3+1 · Bzip3+1

Asarubboo · Publicado 2023-04-06 · Atualizado 2024-08-02 · CVE-2023-29417

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions bzip3 version 1.2.2

Description An issue was discovered in libbzip3.a where there is a bz3 decompress out-of-bounds read in certain situations. This occurs when buffers passed to bzip3 do not contain enough space to be filled with decompressed data. The vendor's perspective is that the observed behavior can only occur for a contract violation.

Recommendations For bzip3 version 1.2.2, consider implementing checks to ensure that buffers passed to bzip3 have enough space to be filled with decompressed data to prevent out-of-bounds reads. As a temporary workaround, consider adding error handling for situations where the decompressed data exceeds the buffer size.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2023-29417

Produtos afetados

Debian

Bzip3

Referências · 14

• 🔥 https://github.com/kspalaiologos/bzip3/issues/97 · Exploit
• https://ubuntu.com/security/CVE-2023-29417 · Aviso do Fabricante
• https://t.me/cvenotify/88558 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2023-29417 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMLFV2FJK3CM7NJLVPZI5RUAFQZICPWW · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-29417 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-29417 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2 · Aviso do Fabricante
• https://t.me/cvenotify/47679 · Publicação no Telegram
• https://t.me/cvenotify/85252 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29417 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29417 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-29417 · Aviso do Fabricante