critical
CVE-2019-12900
bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail).
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner, Julia, Photon OS. Rated lower by Red Hat (medium), AlmaLinux (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium), Amazon (low).
Description
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | bzip2, python3 | 0:1.0.6-15.cm1 and 1 more |
| julia::Julia Ecosystem Security Advisories | Bzip2_jll, Python_jll | 1.0.7+0 and 1 more |
| Photon OS 1.0 | bzip2 | 1.0.6-7.ph1 |
| Photon OS 2.0 | bzip2 | 1.0.6-9.ph2 |
| Photon OS 3.0 | bzip2 | 1.0.6-10.ph3 |
| alma 8 | bzip2, bzip2-devel, bzip2-libs | 1.0.6-28.el8_10 |
| alma 9 | bzip2, bzip2-devel, bzip2-libs | 1.0.8-10.el9_5 |
| alpine 3.10 | bzip2 | 1.0.6-r7 |
| alpine 3.11 | bzip2 | 1.0.6-r7 |
| alpine 3.12 | bzip2 | 1.0.6-r7 |
| alpine 3.13 | bzip2 | 1.0.6-r7 |
| alpine 3.14 | bzip2 | 1.0.6-r7 |
Show all 93 entries from 54 sources
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | bzip2 | 0:1.0.6-15.cm1 |
| CBL-Mariner 1.0 | python3 | 0:3.7.13-1.cm1 |
| julia::Julia Ecosystem Security Advisories | Bzip2_jll | 1.0.7+0 |
| julia::Julia Ecosystem Security Advisories | Python_jll | 3.10.7+0 |
| Photon OS 1.0 | bzip2 | 1.0.6-7.ph1 |
| Photon OS 2.0 | bzip2 | 1.0.6-9.ph2 |
| Photon OS 3.0 | bzip2 | 1.0.6-10.ph3 |
| alma 8 | bzip2 | 1.0.6-28.el8_10 |
| alma 8 | bzip2-devel | 1.0.6-28.el8_10 |
| alma 8 | bzip2-libs | 1.0.6-28.el8_10 |
| alma 9 | bzip2 | 1.0.8-10.el9_5 |
| alma 9 | bzip2-devel | 1.0.8-10.el9_5 |
| alma 9 | bzip2-libs | 1.0.8-10.el9_5 |
| alpine 3.10 | bzip2 | 1.0.6-r7 |
| alpine 3.11 | bzip2 | 1.0.6-r7 |
| alpine 3.12 | bzip2 | 1.0.6-r7 |
| alpine 3.13 | bzip2 | 1.0.6-r7 |
| alpine 3.14 | bzip2 | 1.0.6-r7 |
| alpine 3.15 | bzip2 | 1.0.6-r7 |
| alpine 3.16 | bzip2 | 1.0.6-r7 |
| alpine 3.17 | bzip2 | 1.0.6-r7 |
| alpine 3.18 | bzip2 | 1.0.6-r7 |
| alpine 3.19 | bzip2 | 1.0.6-r7 |
| alpine 3.20 | bzip2 | 1.0.6-r7 |
| alpine 3.21 | bzip2 | 1.0.6-r7 |
| alpine 3.22 | bzip2 | 1.0.6-r7 |
| alpine 3.23 | bzip2 | 1.0.6-r7 |
| alpine 3.24 | bzip2 | 1.0.6-r7 |
| alpine 3.7 | bzip2 | 1.0.6-r7 |
| alpine 3.8 | bzip2 | 1.0.6-r7 |
| alpine 3.9 | bzip2 | 1.0.6-r7 |
| alpine edge | bzip2 | 1.0.6-r7 |
| amazon linux 2 | bzip2 | 1.0.6-13.amzn2.0.3 |
| amazon linux 2 | bzip2-debuginfo | 1.0.6-13.amzn2.0.3 |
| amazon linux 2 | bzip2-devel | 1.0.6-13.amzn2.0.3 |
| amazon linux 2 | bzip2-libs | 1.0.6-13.amzn2.0.3 |
| debian 10 | clamav | 0.101.4+dfsg-0+deb10u1 |
| debian 11 | bzip2 | 1.0.6-9.1 |
| debian 11 | clamav | 0.101.4+dfsg-1 |
| debian 12 | bzip2 | 1.0.6-9.1 |
| debian 12 | clamav | 0.101.4+dfsg-1 |
| debian 13 | bzip2 | 1.0.6-9.1 |
| debian 13 | clamav | 0.101.4+dfsg-1 |
| debian 14 | bzip2 | 1.0.6-9.1 |
| debian 14 | clamav | 0.101.4+dfsg-1 |
| debian 8 | bzip2 | 1.0.6-7+deb8u1 |
| debian 8 | clamav | 0.101.4+dfsg-0+deb8u1 |
| debian 9 | bzip2 | no fix listed |
| debian 9 | clamav | 0.101.4+dfsg-0+deb9u1 |
| echo | bzip2 | 1.0.6-9.1 |
| echo | clamav | 0.101.4+dfsg-1 |
| Oracle Linux 8 | bzip2 | 1.0.6-28.el8_10 |
| Oracle Linux 8 | bzip2-devel | 1.0.6-28.el8_10 |
| Oracle Linux 8 | bzip2-libs | 1.0.6-28.el8_10 |
| Oracle Linux 9 | bzip2 | 1.0.8-10.el9_5 |
| Oracle Linux 9 | bzip2-devel | 1.0.8-10.el9_5 |
| Oracle Linux 9 | bzip2-libs | 1.0.8-10.el9_5 |
| rapidfort alpine 3.20 | rf-python3 | 3.9.25-r0 |
| rapidfort alpine 3.20 | rf-python3.9 | 3.9.25-r1 |
| rapidfort alpine 3.21 | rf-python3 | 3.9.25-r0 |
| rapidfort alpine 3.21 | rf-python3.9 | 3.9.25-r1 |
| rapidfort alpine 3.22 | rf-python3 | 3.9.25-r0 |
| rapidfort alpine 3.22 | rf-python3.9 | 3.9.25-r1 |
| rapidfort alpine 3.23 | rf-python3 | 3.9.25-r0 |
| rapidfort alpine 3.23 | rf-python3.9 | 3.9.25-r1 |
| rapidfort alpine 3.24 | rf-python3 | 3.9.25-r0 |
| rapidfort alpine 3.24 | rf-python3.9 | 3.9.25-r1 |
| rapidfort Oracle Linux 9 | bzip2 | 0:1.0.8-10.el9_5 |
| rapidfort Oracle Linux 9 | bzip2-devel | 0:1.0.8-10.el9_5 |
| rapidfort Oracle Linux 9 | bzip2-libs | 0:1.0.8-10.el9_5 |
| rapidfort rocky 9 | rf-bzip2 | 1.0.8-10.el9_5 |
| Red Hat | bzip2 | no fix listed |
| Red Hat | bzip2-devel | no fix listed |
| Red Hat | bzip2-libs | no fix listed |
| rocky 8 | bzip2 | 1.0.6-28.el8_10 |
| rocky 8 | bzip2-devel | 1.0.6-28.el8_10 |
| rocky 8 | bzip2-libs | 1.0.6-28.el8_10 |
| rocky 9 | bzip2 | 1.0.8-10.el9_5 |
| rocky 9 | bzip2-devel | 1.0.8-10.el9_5 |
| rocky 9 | bzip2-libs | 1.0.8-10.el9_5 |
| ubuntu 14.04-ESM | bzip2 | 1.0.6-5ubuntu0.1~esm2 |
| ubuntu 14.04-ESM | clamav | 0.101.4+dfsg-0ubuntu0.14.04.1+esm1 |
| ubuntu 16.04 | bzip2 | 1.0.6-8ubuntu0.1 |
| ubuntu 16.04 | clamav | 0.101.4+dfsg-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | bzip2 | 1.0.6-8ubuntu0.1 |
| ubuntu 16.04-ESM | clamav | 0.101.4+dfsg-0ubuntu0.16.04.1 |
| ubuntu 18.04 | bzip2 | 1.0.6-8.1ubuntu0.1 |
| ubuntu 18.04 | clamav | 0.101.4+dfsg-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | bzip2 | 1.0.6-8.1ubuntu0.1 |
| ubuntu 18.04-ESM | clamav | 0.101.4+dfsg-0ubuntu0.18.04.1 |
| ubuntu 18.10 | bzip2 | 1.0.6-9ubuntu0.18.10 |
| ubuntu 19.04 | bzip2 | 1.0.6-9ubuntu0.19.04 |
| ubuntu 19.04 | clamav | 0.101.4+dfsg-0ubuntu0.19.04.1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
- https://access.redhat.com/errata/RHSA-2025:0925
- https://access.redhat.com/security/cve/CVE-2019-12900
All 44 references
- https://bugs.launchpad.net/ubuntu/+source/bzip2/+bug/1834494
- https://bugzilla.redhat.com/2332075
- https://bugzilla.redhat.com/show_bug.cgi?id=2332075
- https://cert-portal.siemens.com/productcert/html/ssa-202008.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12900
- https://errata.almalinux.org/9/ALSA-2025-0925.html
- https://errata.rockylinux.org/RLSA-2025:0925
- https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
- https://linux.oracle.com/cve/CVE-2019-12900.html
- https://linux.oracle.com/errata/ELSA-2025-0925.html
- https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b@%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774@%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4@%3Cuser.flink.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html
- https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html
- https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-12900
- https://seclists.org/bugtraq/2019/Aug/4
- https://seclists.org/bugtraq/2019/Jul/22
- https://security.freebsd.org/advisories/FreeBSD-SA-19:18.bzip2.asc
- https://support.f5.com/csp/article/K68713584?utm_source=f5support&%3Butm_medium=RSS
- https://ubuntu.com/security/notices/USN-4038-1
- https://ubuntu.com/security/notices/USN-4038-2
- https://ubuntu.com/security/notices/USN-4038-3
- https://ubuntu.com/security/notices/USN-4038-4
- https://ubuntu.com/security/notices/USN-4146-1
- https://ubuntu.com/security/notices/USN-4146-2
- https://usn.ubuntu.com/4038-1/
- https://usn.ubuntu.com/4038-2/
- https://usn.ubuntu.com/4146-1/
- https://usn.ubuntu.com/4146-2/
- https://www.cve.org/CVERecord?id=CVE-2019-12900
- https://www.oracle.com/security-alerts/cpuoct2020.html