Critical Use-After-Free Vulnerability in bzip2 Package
Summary
ALPINE-CVE-2016-3189: Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block. Affects bzip2 versions < 1.0.6-r5. Fixed in 1.0.6-r5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bzip2 is a widely used data compression program that utilizes the Burrows-Wheeler algorithm to compress files efficiently. It is known for its high compression ratios and is commonly used in various software applications and systems. However, the bzip2 package has been found to contain a critical vulnerability that can be exploited by attackers, leading to potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2016-3189, is a use-after-free flaw in the bzip2recover utility of the bzip2 package version 1.0.6. This flaw allows remote attackers to craft malicious bzip2 files that, when processed, can cause the application to crash. The root cause of this issue lies in improper memory management, where the program attempts to access memory that has already been freed. This can lead to application instability and denial of service, affecting users and systems relying on bzip2 for data compression.
How To Fix
Minimum fixed version
1.0.6-r5
This is the first release that contains the fix.
sudo apk add --upgrade bzip2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider temporarily disabling the use of bzip2 for file compression until the package can be updated. Additionally, avoid processing untrusted or unknown bzip2 files to mitigate the risk of exploitation.
Conclusion
The bzip2 package has a critical vulnerability (CVE-2016-3189) that can lead to denial of service due to improper memory management. Users are advised to update to the patched version 1.0.6-r5 to mitigate risks. For those unable to update immediately, it is recommended to avoid processing untrusted files.
See every vulnerability recorded for bzip2 →
FAQ
CVE-2016-3189 is a use-after-free vulnerability in the bzip2 package that can lead to denial of service when processing crafted bzip2 files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary impact is a denial of service, where the application may crash when processing malicious bzip2 files, affecting system availability.
Yes, the CVSS score for CVE-2016-3189 is 6.5, indicating a moderate severity level.
If you cannot update the package, avoid processing untrusted bzip2 files and consider disabling bzip2 until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for bzip2.
