PT-2023-22245 · Bzip3+1 · Bzip3+1

Asarubboo · Published 2023-04-06 · Updated 2024-08-02 · CVE-2023-29417

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions bzip3 version 1.2.2

Description An issue was discovered in libbzip3.a where there is a bz3 decompress out-of-bounds read in certain situations. This occurs when buffers passed to bzip3 do not contain enough space to be filled with decompressed data. The vendor's perspective is that the observed behavior can only occur for a contract violation.

Recommendations For bzip3 version 1.2.2, consider implementing checks to ensure that buffers passed to bzip3 have enough space to be filled with decompressed data to prevent out-of-bounds reads. As a temporary workaround, consider adding error handling for situations where the decompressed data exceeds the buffer size.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-29417

Affected Products

Debian

Bzip3

References · 14

• 🔥 https://github.com/kspalaiologos/bzip3/issues/97 · Exploit
• https://ubuntu.com/security/CVE-2023-29417 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-29417 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMLFV2FJK3CM7NJLVPZI5RUAFQZICPWW · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29417 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-29417 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29417 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29417 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29417 · Vendor Advisory
• https://t.me/cvenotify/88558 · Telegram Post
• https://t.me/cvenotify/47679 · Telegram Post
• https://t.me/cvenotify/85252 · Telegram Post