CVE-2019-12900: Bzip BZIP2

Critical severity, CVSS 9.8. EPSS: 8% chance of exploitation in the next 30 days.

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Affected products

• Bzip BZIP2: up to and including 1.0.6
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only
• Freebsd Freebsd: version 11.2 only; version 11.3 only; version 12.0 only
• Opensuse Leap: version 15.0 only; version 15.1 only
• Python Python: from 3.7.0, before 3.7.13 (fixed in 3.7.13); from 3.8.0, before 3.8.13 (fixed in 3.8.13); from 3.9.0, before 3.9.11 (fixed in 3.9.11); from 3.10.0, before 3.10.3 (fixed in 3.10.3)

Published 2019-06-19. Last modified 2026-06-17.