HSEC-2024-0002
NoneCVSS
—
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
out-of-bounds write when there are many bzip2 selectors
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.10 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.11 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.12 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.13 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.14 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.15 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.16 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.17 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.18 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.19 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.20 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.21 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.22 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.7 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.8 | bzip2 | 0 | 1.0.6-r7 |
| Alpine:v3.9 | bzip2 | 0 | 1.0.6-r7 |
| Debian:11 | bzip2 | 0 | 1.0.6-9.1 |
| Debian:11 | clamav | 0 | 0.101.4+dfsg-1 |
| Debian:12 | bzip2 | 0 | 1.0.6-9.1 |
| Debian:12 | clamav | 0 | 0.101.4+dfsg-1 |
| Debian:13 | bzip2 | 0 | 1.0.6-9.1 |
| Debian:13 | clamav | 0 | 0.101.4+dfsg-1 |
| Hackage | bz2 | 0.1.0.0 | 1.0.1.1 |
| Hackage | bzlib | 0.4 | 0.5.2.0 |
| Hackage | bzlib-conduit | 0.1.0.0 | 0.3.0.3 |
| Ubuntu:16.04:LTS | bzip2 | 0 | 1.0.6-8ubuntu0.2 |
| Ubuntu:16.04:LTS | clamav | 0 | 0.101.4+dfsg-0ubuntu0.16.04.1 |
| Ubuntu:18.04:LTS | bzip2 | 0 | 1.0.6-8.1ubuntu0.2 |
| Ubuntu:18.04:LTS | clamav | 0 | 0.101.4+dfsg-0ubuntu0.18.04.1 |
| Ubuntu:Pro:14.04:LTS | bzip2 | 0 | 1.0.6-5ubuntu0.1~esm2 |
| Ubuntu:Pro:14.04:LTS | clamav | 0 | 0.101.4+dfsg-0ubuntu0.14.04.1+esm1 |
Related vulnerabilities
- CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to… Also affects bzip2
- CVE-2025-20128 A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV… Also affects clamav
- CVE-2024-20506 A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0… Also affects clamav
- CVE-2024-20505 A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0… Also affects clamav
- CVE-2023-20197 A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+)… Also affects clamav
- CVE-2023-20052 On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was… Also affects clamav
- CVE-2023-20032 On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was… Also affects clamav
- CVE-2017-6418 libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service… Also affects clamav