PT-2025-45888 · Julia · Bzip2 Jll+1

Published 2025-10-09 · Updated 2025-10-09

OSV

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

Related Identifiers

JLSEC-2025-10

Affected Products

Bzip2 Jll

Python Jll

References · 26

• https://osv.dev/vulnerability/JLSEC-2025-10 · Vendor Advisory
• https://seclists.org/bugtraq/2019/Jul/22 · Note
• https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html · Note
• https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E · Note
• http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html · Note
• https://usn.ubuntu.com/4038-1 · Note
• https://oracle.com/security-alerts/cpuoct2020.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1319648 · Note
• https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E · Note
• http://securityfocus.com/bid/91297 · Note
• http://oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html · Note
• https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E · Note
• https://security.freebsd.org/advisories/FreeBSD-SA-19:18.bzip2.asc · Note