{"id":"CVE-2016-3189","aliases":["ALPINE-CVE-2016-3189","BELL-CVE-2016-3189","CLSA-2026-1776956583","CLSA-2026-1776961553","CLSA-2026-1776965760","DEBIAN-CVE-2016-3189","DLA-1833-1","EUVD-2016-4230","GHSA-mg3q-2g68-qp7w","JLSEC-2025-10","MGASA-2016-0400","PSF-2016-5","SUSE-SU-2019:1206-1","SUSE-SU-2019:1206-2","SUSE-SU-2019:14122-1","SUSE-SU-2019:1955-1","UBUNTU-CVE-2016-3189","USN-4038-1","USN-4038-2","openSUSE-SU-2019:1398-1","openSUSE-SU-2019:1435-1","openSUSE-SU-2024:10667-1"],"status":"published","title":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a...","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.15685,"percentile":0.96876,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2016-06-30T00:00:00Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"bzip2","fixed_in":["1.0.6-r5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bzip2","fixed_in":["1.0.6-8.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bzip2","fixed_in":["1.0.6-8.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bzip2","fixed_in":["1.0.6-8.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Bzip2_jll","fixed_in":["1.0.7+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"Python_jll","fixed_in":["3.10.7+0"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"bzip2","fixed_in":["1.0.6-7.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"bzip2","fixed_in":["1.0.6-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"bzip2","fixed_in":["1.0.6-5.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bzip2","fixed_in":["1.0.6-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"bzip2","fixed_in":["1.0.6-8ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"bzip2","fixed_in":["1.0.6-lp150.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"bzip2","fixed_in":["1.0.6-lp151.5.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-r5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bzip2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bzip2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"bzip2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"bzip2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"bzip2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"bzip2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-13.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-7+deb8u1"}]}],"versions":["1.0.6-7"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"Bzip2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.7+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Python_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.7+0"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-7.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-34.256.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-34.256.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5ubuntu0.1~esm1"}]}],"versions":["1.0.6-4","1.0.6-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.1"}]}],"versions":["1.0.6-8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.1"}]}],"versions":["1.0.6-8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1ubuntu0.1"}]}],"versions":["1.0.6-8.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5ubuntu0.1~esm1"}]}],"versions":["1.0.6-4","1.0.6-5"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-lp150.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-lp151.5.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-3.2"}]}],"bundled":3}],"products":[{"vendor":"bzip","product":"bzip2"},{"vendor":"python","product":"python"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/06/20/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"http://www.securitytracker.com/id/1036132","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.securityfocus.com/bid/91297","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201708-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4038-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4038-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Jul/22","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Aug/4","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1319648","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189"},{"url":"https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3@%3Cjira.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af@%3Cdev.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260@%3Cjira.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305@%3Cjira.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203@%3Cjira.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c@%3Cjira.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301@%3Cjira.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b@%3Cusers.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73@%3Cdev.kafka.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e@%3Cjira.kafka.apache.org%3E"},{"url":"https://usn.ubuntu.com/4038-2"},{"url":"https://usn.ubuntu.com/4038-1"},{"url":"https://github.com/advisories/GHSA-mg3q-2g68-qp7w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-3189","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-3189","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776956583.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1776961553.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1776965760.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3189","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0400.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18742","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/06/20/1","tags":["web"]},{"url":"https://access.redhat.com/security/cve/cve-2016-3189","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/cve-2019-12900","tags":["advisory"]},{"url":"https://bugs.python.org/issue44549","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191206-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/985657","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3189","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191206-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914122-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1139083","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12900","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191955-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-3189","tags":["report"]},{"url":"https://marc.info/?l=oss-security\u0026m=146642106322396\u0026w=2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4038-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4038-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12900","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AZOAIG3ZRFB4G3OJLLK5642AFVIYJNTD/#AZOAIG3ZRFB4G3OJLLK5642AFVIYJNTD","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7VRUBSDP7NDWZ4MG7YOXMK7M2QH7IBYO/#7VRUBSDP7NDWZ4MG7YOXMK7M2QH7IBYO","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1372","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T17:00:00Z","modified":"2026-10-14T06:25:23.953Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2016-4230","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T17:00:00Z","modified":"2026-10-14T06:25:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-mg3q-2g68-qp7w","title":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a...","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2022-05-13T01:07:00Z","modified":"2026-10-14T09:31:15Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T17:59:01.47Z","modified":"2026-10-14T07:16:37.42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"ALPINE-CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T17:59:01.47Z","modified":"2026-09-22T06:17:50.317671808Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"BELL-CVE-2016-3189","title":"CVE-2016-3189 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:28.597253Z","modified":"2026-01-26T09:49:57.126392Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T17:59:01.47Z","modified":"2026-10-24T10:30:58.029224114Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T17:59:01.47Z","modified":"2026-10-14T11:47:28.482762217Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"JLSEC-2025-10","title":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a...","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2025-10-09T21:46:55.585Z","modified":"2026-07-23T22:30:05.033152657Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T00:00:00Z","modified":"2026-04-22T10:40:57.662603Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"CLSA-2026-1776956583","title":"bzip2: Fix of 2 CVEs","description":"- CVE-2019-12900: fix out-of-bounds write in BZ2_decompress when many\n  selectors are present\n- CVE-2016-3189: fix use-after-free in bzip2recover","status":"published","published":"2026-04-25T08:42:48Z","modified":"2026-10-21T10:48:04.893375339Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1776961553","title":"bzip2: Fix of 2 CVEs","description":"- CVE-2019-12900: fix out-of-bounds write in BZ2_decompress when many\n  selectors are present\n- CVE-2016-3189: fix use-after-free in bzip2recover","status":"published","published":"2026-04-23T16:25:58Z","modified":"2026-10-21T10:48:02.574988399Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1776965760","title":"bzip2: Fix of 2 CVEs","description":"- CVE-2019-12900: fix out-of-bounds write in BZ2_decompress when many\n  selectors are present\n- CVE-2016-3189: fix use-after-free in bzip2recover","status":"published","published":"2026-04-23T17:36:05Z","modified":"2026-10-21T10:48:14.10744664Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-1833-1","title":"bzip2 - security update","status":"published","published":"2019-06-24T00:00:00Z","modified":"2026-03-09T01:19:45.050691Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2016-0400","title":"Updated bzip2 packages fix security vulnerability","description":"A use-after-free flaw was found in bzip2recover, leading to a null\npointer dereference, or a write to a closed file descriptor. An attacker\ncould use this flaw by sending a specially crafted bzip2 file to recover\nand force the program to crash (CVE-2016-3189).\n","status":"published","published":"2016-11-26T10:41:56Z","modified":"2026-04-16T06:26:22.971962394Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2019:1398-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-15T14:47:05Z","modified":"2026-02-04T03:49:26.343756Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1435-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-22T16:39:18Z","modified":"2026-02-04T03:35:26.188917Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10667-1","title":"bzip2-1.0.8-3.2 on GA media","description":"These are all security issues fixed in the bzip2-1.0.8-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:58.95433Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"PSF-2016-5","title":"Windows: vulnerable bzip2 1.0.6","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.","status":"published","published":"2016-06-30T17:00:00Z","modified":"2025-10-09T00:58:16.303346Z","updated_at":"2026-11-02T15:52:50.263679Z"},{"id":"SUSE-SU-2019:1206-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).\n","status":"published","published":"2019-05-10T12:01:58Z","modified":"2026-02-04T03:51:08.899108Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1206-2","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).\n","status":"published","published":"2019-07-03T08:55:58Z","modified":"2026-02-04T02:31:09.449972Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:14122-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083).\n- CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).\n","status":"published","published":"2019-07-15T12:39:49Z","modified":"2026-02-04T04:06:10.672943Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1955-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083).\n- CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).\n","status":"published","published":"2019-07-23T09:43:27Z","modified":"2026-02-04T02:22:03.121205Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4038-1","title":"bzip2 vulnerabilities","description":"Aladdin Mubaied discovered that bzip2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-3189)\n\nIt was discovered that bzip2 incorrectly handled certain files.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2019-12900)\n","status":"published","published":"2019-06-26T12:01:55Z","modified":"2026-04-22T09:57:32.508994Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4038-2","title":"bzip2 vulnerabilities","description":"USN-4038-1 fixed several vulnerabilities in bzip2. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Aladdin Mubaied discovered that bzip2 incorrectly handled certain files.\n An attacker could possibly use this issue to cause a denial of service.\n (CVE-2016-3189)\n\n It was discovered that bzip2 incorrectly handled certain files.\n An attacker could possibly use this issue to execute arbitrary code.\n (CVE-2019-12900)\n","status":"published","published":"2019-06-26T13:58:15Z","modified":"2026-04-22T09:58:13.676454Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}