~ / search / GHSA-96jv-r488-c2rj

GHSA-96jv-r488-c2rj

bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow

Source: GitHub Advisory Database (reviewed) High CVE-2023-22895

Packages

EcosystemPackageAffectedFixed in
crates.io bzip2 < 0.4.4 0.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in `mem.rs`. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

References

External links from the advisory. They lead to third-party sites.