CVE:CVE-2019-12900
CNNVD:CNNVD-201906-734
bzip2是一款开源的压缩/解压缩应用程序。
bzip2 1.0.6及之前版本中的decompress.c文件的BZ2_decompress存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。
solution:Upgrade bzip bzip2 to a higher version than 1.0.6,and avoid the version (,1.0.6]; Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade opensuse leap to a higher version than 15.0,15.1,and avoid the version 15.0,15.1; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,16.04,18.04,19.04,and avoid the version 12.04,14.04,16.04,18.04,19.04; Upgrade freebsd freebsd to a higher version than 11.2,11.2:p10,11.2:p11,11.2:p12,11.2:p2,11.2:p3,11.2:p4,11.2:p5,11.2:p6,11.2:p7,11.2:p8,11.2:p9,11.2:rc3,11.3,11.3:p1,12.0,12.0:p1,12.0:p2,12.0:p3,12.0:p4,12.0:p5,12.0:p6,12.0:p7,12.0:p8,and avoid the version 11.2,11.2:p10,11.2:p11,11.2:p12,11.2:p2,11.2:p3,11.2:p4,11.2:p5,11.2:p6,11.2:p7,11.2:p8,11.2:p9,11.2:rc3,11.3,11.3:p1,12.0,12.0:p1,12.0:p2,12.0:p3,12.0:p4,12.0:p5,12.0:p6,12.0:p7,12.0:p8; Upgrade python python to a higher version than 3.7.13,3.8.13,3.9.11,3.10.3,and avoid the version [3.7.0,3.7.13),[3.8.0,3.8.13),[3.9.0,3.9.11),[3.10.0,3.10.3)