Use-after-free memory corruption in bzip2recover in bzip2 - CVE-2016-3189

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU12

Use-after-free memory corruption in bzip2recover in bzip2 - CVE-2016-3189

Published: June 21, 2016 / Updated: July 8, 2016


Vulnerability identifier: #VU12
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-3189
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause the target application to crash.

The vulnerability exists due to an use-after-free error in bzip2recover when handling bzip2 files. A remote unauthenticated attacker can send a specially crafted bzip2 archive and cause the target application to crash.

Successful exploitation of this vulnerability will result in denial of service.


Affected software

bzip2
Gentoo Linux
Arch Linux
FreeBSD
Slackware Linux
Opensuse
Fedora
bzip2 (Alpine package)
bzip2
Dell EMC AppSync
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
IBM License Metric Tool

How to mitigate CVE-2016-3189


bzip2 (Alpine package) - update to 1.0.6-r5
bzip2 - addressed in versions 1.0.6-21.fc24, 1.0.6-21.fc25
Dell EMC AppSync - update to 4.4.1.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.2.0.5.009
Dell EMC Unity XT Operating Environment (OE) - update to 5.0.2.0.5.009
Dell EMC Unity Operating Environment (OE) - update to 5.0.2.0.5.009
IBM License Metric Tool - update to 9.2.34

External References

Related Security Bulletins