CVE-2023-29415

MEDIUM

bzip3 < 1.3.0 - Denial of Service via Crafted Archive

Title source: llm

Description

An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais.

References (6)

Core 6

Core References

Patch

https://github.com/kspalaiologos/bzip3/compare/1.2.3...1.3.0

Exploit, Issue Tracking, Patch, Third Party Advisory

https://github.com/kspalaiologos/bzip3/issues/95

Third Party Advisory

https://security-tracker.debian.org/tracker/CVE-2023-29415

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMLFV2FJK3CM7NJLVPZI5RUAFQZICPWW/

Scores

CVSS v3 6.5

EPSS 0.0085

EPSS Percentile 75.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (2)

bzip3_project/bzip3 < 1.3.0

debian/debian_linux 12.0

Published Apr 06, 2023

Tracked Since Feb 18, 2026