hsec-2024-0002
osv_haskell
Description
# out-of-bounds write when there are many bzip2 selectors A malicious bzip2 payload may produce a memory corruption resulting in a denial of service and/or remote code execution. Network services or command line utilities decompressing untrusted bzip2 payloads are affected. Note that the exploitation of this bug relies on an undefined behavior that appears to be handled safely by current compilers. The Haskell libraires are vulnerable when they are built using the bundled C library source code, which is the default in most cases.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2024/HSEC-2024-0002.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2024/HSEC-2024-0002.json",
"source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2024/HSEC-2024-0002.json"
},
"package": {
"ecosystem": "Hackage",
"name": "bzlib",
"purl": "pkg:hackage/bzlib"
},
"ranges": [
{
"events": [
{
"introduced": "0.4"
},
{
"fixed": "0.5.2.0"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"versions": [
"0.4",
"0.4.0.1",
"0.4.0.3",
"0.5.0.0",
"0.5.0.1",
"0.5.0.2",
"0.5.0.3",
"0.5.0.4",
"0.5.0.5",
"0.5.1.0"
]
},
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2024/HSEC-2024-0002.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2024/HSEC-2024-0002.json",
"source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2024/HSEC-2024-0002.json"
},
"package": {
"ecosystem": "Hackage",
"name": "bz2",
"purl": "pkg:hackage/bz2"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.0.0"
},
{
"fixed": "1.0.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"versions": [
"0.1.0.0",
"0.1.0.1",
"0.1.1.0",
"0.1.1.1",
"1.0.0.0",
"1.0.0.1",
"1.0.0.2",
"1.0.0.3",
"1.0.1.0"
]
},
{
"database_specific": {
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2024/HSEC-2024-0002.md",
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2024/HSEC-2024-0002.json",
"source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2024/HSEC-2024-0002.json"
},
"package": {
"ecosystem": "Hackage",
"name": "bzlib-conduit",
"purl": "pkg:hackage/bzlib-conduit"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.0.0"
},
{
"fixed": "0.3.0.3"
}
],
"type": "ECOSYSTEM"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"versions": [
"0.1.0.0",
"0.1.0.1",
"0.2.0.0",
"0.2.1.0",
"0.2.1.1",
"0.2.1.2",
"0.2.1.3",
"0.2.1.4",
"0.2.1.5",
"0.3.0",
"0.3.0.1",
"0.3.0.2"
]
}
],
"aliases": [
"CVE-2019-12900",
"PSF-2019-4"
],
"database_specific": {
"home": "https://github.com/haskell/security-advisories",
"osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
"repository": "https://github.com/haskell/security-advisories"
},
"details": "# out-of-bounds write when there are many bzip2 selectors\n\nA malicious bzip2 payload may produce a memory corruption\nresulting in a denial of service and/or remote code execution.\nNetwork services or command line utilities decompressing\nuntrusted bzip2 payloads are affected.\n\nNote that the exploitation of this bug relies on an undefined\nbehavior that appears to be handled safely by current compilers.\n\nThe Haskell libraires are vulnerable when they are built using\nthe bundled C library source code, which is the default\nin most cases.\n",
"id": "HSEC-2024-0002",
"modified": "2025-11-14T18:15:42.213328Z",
"published": "2025-11-14T14:45:34Z",
"references": [
{
"type": "DISCUSSION",
"url": "https://gnu.wildebeest.org/blog/mjw/2019/08/02/bzip2-and-the-cve-that-wasnt/"
},
{
"type": "DISCUSSION",
"url": "http://scary.beasts.org/security/CESA-2008-005.html"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/security/cve/cve-2019-12900"
},
{
"type": "FIX",
"url": "https://sourceware.org/git/?p=bzip2.git;a=commit;h=7ed62bfb46e87a9e878712603469440e6882b184"
}
],
"schema_version": "1.7.5",
"summary": "out-of-bounds write when there are many bzip2 selectors"
}