{"schema_version":"1.8.0","id":"CVE-2019-12900","published":"2019-06-19T23:15:09.910Z","modified":"2026-08-07T14:49:09.063846Z","aliases":["HSEC-2024-0002","PSF-2019-4"],"related":["ALSA-2024:8922","ALSA-2025:0733","ALSA-2025:0925","SUSE-SU-2019:14122-1","SUSE-SU-2019:14139-1","SUSE-SU-2019:14231-1","SUSE-SU-2019:1846-1","SUSE-SU-2019:1955-1","SUSE-SU-2019:2004-1","SUSE-SU-2019:2013-1","SUSE-SU-2019:2013-2","SUSE-SU-2019:3053-1","SUSE-SU-2019:3066-1","SUSE-SU-2020:3729-1","SUSE-SU-2020:3790-1","SUSE-SU-2020:3918-1","openSUSE-SU-2019:1781-1","openSUSE-SU-2019:1918-1","openSUSE-SU-2019:2595-1","openSUSE-SU-2019:2597-1","openSUSE-SU-2020:2268-1","openSUSE-SU-2020:2276-1","openSUSE-SU-2024:10667-1","openSUSE-SU-2024:10685-1"],"details":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"1bf9cc509326bc42cd8cb1650eb9bf64550d817e"},{"fixed":"000593c0f97ac9b75b56064a957b84a3aaa60674"},{"introduced":"fa919fdf2583bdfead1df00e842f24f30b2a34bf"},{"fixed":"ea673213dd30afd8cacb53927e7d86f6125e86c8"},{"introduced":"9cf6752276e6fcfd0c23fdb064ad27f448aaaf75"},{"fixed":"2de452f8bf2f78417e04bcf7919beb502c53a0e2"},{"introduced":"b494f5935c92951e75597bfe1c8b1f3112fec270"},{"fixed":"a342a49189c16f01e7b95e0bf22ea2bd539222cd"}],"database_specific":{"cpe":"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.7.0"},{"fixed":"3.7.13"},{"introduced":"3.8.0"},{"fixed":"3.8.13"},{"introduced":"3.9.0"},{"fixed":"3.9.11"},{"introduced":"3.10.0"},{"fixed":"3.10.3"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12900.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.com/federicomenaquintero/bzip2","events":[{"introduced":"0"},{"fixed":"74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12900.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["193662908927078745708702042109529205902","16813243021549239572194252372936960661","154544188480167473863108834568414589177","294592855379212741126804546922529497937"],"threshold":0.9},"id":"CVE-2019-12900-85543407","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/federicomenaquintero/bzip2@74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","target":{"file":"decompress.c"}},{"deprecated":false,"digest":{"function_hash":"188338681100398363911181230312621404683","length":13498},"id":"CVE-2019-12900-fedadc1c","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/federicomenaquintero/bzip2@74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","target":{"file":"decompress.c","function":"BZ2_decompress"}}],"vanir_signatures_modified":"2026-08-07T14:49:09Z"}}],"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E"},{"type":"WEB","url":"https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html"},{"type":"ADVISORY","url":"https://seclists.org/bugtraq/2019/Jul/22"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4038-1/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4038-2/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4146-1/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4146-2/"},{"type":"FIX","url":"https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc"},{"type":"FIX","url":"https://seclists.org/bugtraq/2019/Aug/4"},{"type":"FIX","url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:bzip:bzip2:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"1.0.6"}],"source":"CPE_RANGE","vendor_product":"bzip:bzip2"},{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.04"},{"last_affected":"12.04"},{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"19.04"},{"last_affected":"19.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:freebsd:freebsd:11.2:-:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p10:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p11:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p12:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p2:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p3:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p4:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p5:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p6:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p7:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p8:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:p9:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.2:rc3:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.3:-:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:11.3:p1:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p5:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p7:*:*:*:*:*:*","cpe:2.3:o:freebsd:freebsd:12.0:p8:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.2-NA"},{"last_affected":"11.2-NA"},{"introduced":"11.2-p10"},{"last_affected":"11.2-p10"},{"introduced":"11.2-p11"},{"last_affected":"11.2-p11"},{"introduced":"11.2-p12"},{"last_affected":"11.2-p12"},{"introduced":"11.2-p2"},{"last_affected":"11.2-p2"},{"introduced":"11.2-p3"},{"last_affected":"11.2-p3"},{"introduced":"11.2-p4"},{"last_affected":"11.2-p4"},{"introduced":"11.2-p5"},{"last_affected":"11.2-p5"},{"introduced":"11.2-p6"},{"last_affected":"11.2-p6"},{"introduced":"11.2-p7"},{"last_affected":"11.2-p7"},{"introduced":"11.2-p8"},{"last_affected":"11.2-p8"},{"introduced":"11.2-p9"},{"last_affected":"11.2-p9"},{"introduced":"11.2-rc3"},{"last_affected":"11.2-rc3"},{"introduced":"11.3-NA"},{"last_affected":"11.3-NA"},{"introduced":"11.3-p1"},{"last_affected":"11.3-p1"},{"introduced":"12.0-NA"},{"last_affected":"12.0-NA"},{"introduced":"12.0-p1"},{"last_affected":"12.0-p1"},{"introduced":"12.0-p2"},{"last_affected":"12.0-p2"},{"introduced":"12.0-p3"},{"last_affected":"12.0-p3"},{"introduced":"12.0-p4"},{"last_affected":"12.0-p4"},{"introduced":"12.0-p5"},{"last_affected":"12.0-p5"},{"introduced":"12.0-p6"},{"last_affected":"12.0-p6"},{"introduced":"12.0-p7"},{"last_affected":"12.0-p7"},{"introduced":"12.0-p8"},{"last_affected":"12.0-p8"}],"source":"CPE_STRING","vendor_product":"freebsd:freebsd"},{"cpes":["cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"15.1"},{"last_affected":"15.1"}],"source":"CPE_STRING","vendor_product":"opensuse:leap"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}