Bug 9935 - bzip2 v1.0.6 has open CVEs: CVE-2016-3189
Summary: bzip2 v1.0.6 has open CVEs: CVE-2016-3189
Status: RESOLVED WONTFIX
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 2.2 M2
Assignee: Alexander Kanavin
QA Contact: David Rodriguez
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2016-07-14 08:59 UTC by Amaranth Valluri
Modified: 2016-08-01 13:02 UTC (History)
7 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Alexander Kanavin 2016-07-15 13:27:50 UTC 
Another low severity issue - this can only cause a crash when rarely used bzip2recover is used with a malicious file.
Comment 2 Maxin B. John 2016-08-01 13:02:19 UTC 
Armin's fix is now available in master branch:
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?h=master-next&id=3aaf0232027629b868c85a8f86c2d26e5e9c7ea9