Bug 9935

Summary: bzip2 v1.0.6 has open CVEs: CVE-2016-3189
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Amaranth Valluri <amarnath.valluri>
Component: coreAssignee: Alexander Kanavin <alex.kanavin>
Status: RESOLVED WONTFIX QA Contact: David Rodriguez <david.israelx.rodriguez.castellanos>
Severity: normal    
Priority: Medium+ CC: akuster, jose.perez.carranza, maxin.john, meta.mr.watcher, meta.watcher, patrick.ohly, sgw
Version: unspecified   
Target Milestone: 2.2 M2   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Comment 1 Alexander Kanavin 2016-07-15 13:27:50 UTC
Another low severity issue - this can only cause a crash when rarely used bzip2recover is used with a malicious file.
Comment 2 Maxin B. John 2016-08-01 13:02:19 UTC
Armin's fix is now available in master branch:
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?h=master-next&id=3aaf0232027629b868c85a8f86c2d26e5e9c7ea9