This update for bzip2 fixes the following issues :

Security issue fixed :

CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083).

CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2019:14139-1 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ClamAV 0.101.4 is a security patch release that addresses the following issues.

  - An out of bounds write was possible within ClamAV's NSIS     bzip2 library when attempting decompression in cases     where the number of selectors exceeded the max limit set     by the library (CVE-2019-12900). The issue has been     resolved by respecting that limit.

    Thanks to Martin Simmons for reporting the issue here.

  - The zip bomb vulnerability mitigated in 0.101.3 has been     assigned the CVE identifier CVE-2019-12625.
    Unfortunately, a workaround for the zip-bomb mitigation     was immediately identified. To remediate the zip-bomb     scan time issue, a scan time limit has been introduced     in 0.101.4. This limit now resolves ClamAV's     vulnerability to CVE-2019-12625.

    The default scan time limit is 2 minutes (120000     milliseconds).

    To customize the time limit :

  - use the clamscan --max-scantime option

  - use the clamd MaxScanTime config option

    Libclamav users may customize the time limit using the     cl_engine_set_num function. For example :

    C cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME,     time_limit_milliseconds)

    Thanks to David Fifield for reviewing the zip-bomb     mitigation in 0.101.3 and reporting the issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14231-1 advisory.

  - ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated     attacker can cause a denial of service condition by sending crafted messages to an affected system.
    (CVE-2019-12625)

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K68713584 advisory.

    BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors.(CVE-2019-12900)ImpactBIG-IP AAMIf an iSession tunnel is configured with an iSession profile     that has bzip2 compression enabled, an attacker using specially crafted compressed files can exploit a     vulnerability that exists in the decompress functionality of thebzip2utility, causing an out-of-bounds     write. For more information about out-of-bounds writes, refer toCWE-787: Out-of-bounds Write.Note: This     link takes you to a resource outside of AskF5, and the third party could remove the document without our     knowledge.BIG-IP, BIG-IQ, Enterprise Manager, iWorkflow, and Traffix SDCA locally authenticated attacker,     using specially crafted compressed files, can exploit a vulnerability that exists in the decompress     functionality of thebzip2utility, causing an out-of-bounds write. For more information about out-of-bounds     writes, refer toCWE-787: Out-of-bounds Write.Note: This link takes you to a resource outside of AskF5, and     the third party could remove the document without our knowledge.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the bzip2 package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10803 advisory.

    The bzip2 packages contain a freely available, high-quality data compressor. It provides both standalone     compression and decompression utilities, as well as a shared library for use with other programs.

    Security Fix(es):

    * bzip2: out-of-bounds write in function BZ2_decompress (CVE-2019-12900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:0733 advisory.

    * bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail). (CVE-2019-12900)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:0733 advisory.

    * bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail). (CVE-2019-12900)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:0925 advisory.

    * bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail). (CVE-2019-12900)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:8922 advisory.

    * bzip2: out-of-bounds write in function BZ2_decompress (CVE-2019-12900)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:8922 advisory.

    * bzip2: out-of-bounds write in function BZ2_decompress (CVE-2019-12900)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	Name	Product	Family	Published	Updated	Severity
126985	SUSE SLED12 / SLES12 Security Update : bzip2 (SUSE-SU-2019:1955-1)	Nessus	SuSE Local Security Checks	7/24/2019	5/8/2024	critical
150600	SUSE SLES11 Security Update : bzip2 (SUSE-SU-2019:14139-1)	Nessus	SuSE Local Security Checks	6/10/2021	6/10/2021	critical
128132	Fedora 30 : clamav (2019-5c2dc50262)	Nessus	Fedora Local Security Checks	8/26/2019	5/1/2024	critical
150535	SUSE SLES11 Security Update : clamav (SUSE-SU-2019:14231-1)	Nessus	SuSE Local Security Checks	6/10/2021	6/10/2021	critical
176552	F5 Networks BIG-IP : bzip2 vulnerability (K68713584)	Nessus	F5 Networks Local Security Checks	6/1/2023	6/27/2025	critical
203035	Photon OS 3.0: Bzip2 PHSA-2019-3.0-0023	Nessus	PhotonOS Local Security Checks	7/23/2024	7/24/2024	critical
212070	RHEL 9 : bzip2 (RHSA-2024:10803)	Nessus	Red Hat Local Security Checks	12/5/2024	3/20/2025	critical
214762	AlmaLinux 8 : bzip2 (ALSA-2025:0733)	Nessus	Alma Linux Local Security Checks	1/29/2025	1/29/2025	critical
216302	RockyLinux 8 : bzip2 (RLSA-2025:0733)	Nessus	Rocky Linux Local Security Checks	2/14/2025	2/14/2025	critical
232927	RockyLinux 9 : bzip2 (RLSA-2025:0925)	Nessus	Rocky Linux Local Security Checks	3/19/2025	3/19/2025	critical
210436	AlmaLinux 8 : bzip2 (ALSA-2024:8922)	Nessus	Alma Linux Local Security Checks	11/6/2024	11/6/2024	critical
210609	RockyLinux 8 : bzip2 (RLSA-2024:8922)	Nessus	Rocky Linux Local Security Checks	11/8/2024	11/8/2024	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	6/30/2023	7/6/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical