---
id: CVE-2019-12900
title: >-
  BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds
  write when there are many selectors.
summary: >-
  BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds
  write when there are many selectors.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
  - CWE-787
vendor: bzip
product: bzip2
affected:
  - bzip2 <= 1.0.6
  - debian_linux = 8.0
  - leap = 15.0
  - leap = 15.1
  - ubuntu_linux = 12.04
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 19.04
  - freebsd = 11.2
  - freebsd = 11.3
  - freebsd = 12.0
  - 'python >= 3.7.0, < 3.7.13'
  - 'python >= 3.8.0, < 3.8.13'
  - 'python >= 3.9.0, < 3.9.11'
  - 'python >= 3.10.0, < 3.10.3'
patched:
  - python 3.10.3
published: '2019-06-19'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:45.443'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-12900'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html'
    label: cve@mitre.org
  - url: >-
      http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
    label: cve@mitre.org
  - url: >-
      http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
    label: cve@mitre.org
  - url: >-
      https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
    label: cve@mitre.org
  - url: >-
      https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E
    label: cve@mitre.org
  - url: >-
      https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E
    label: cve@mitre.org
  - url: >-
      https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html'
    label: cve@mitre.org
  - url: 'https://seclists.org/bugtraq/2019/Aug/4'
    label: cve@mitre.org
  - url: 'https://seclists.org/bugtraq/2019/Jul/22'
    label: cve@mitre.org
  - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc'
    label: cve@mitre.org
  - url: >-
      https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4038-1/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4038-2/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4146-1/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4146-2/'
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2019/Aug/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://seclists.org/bugtraq/2019/Jul/22'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4038-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4038-2/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4146-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4146-2/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-202008.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.07977
epssPercentile: 0.94643
ingestedAt: '2026-10-14T07:21:04.815Z'
---

## Overview

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

## Affected

- `bzip2 <= 1.0.6`
- `debian_linux = 8.0`
- `leap = 15.0`
- `leap = 15.1`
- `ubuntu_linux = 12.04`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 19.04`
- `freebsd = 11.2`
- `freebsd = 11.3`
- `freebsd = 12.0`
- `python >= 3.7.0, < 3.7.13`
- `python >= 3.8.0, < 3.8.13`
- `python >= 3.9.0, < 3.9.11`
- `python >= 3.10.0, < 3.10.3`

## Remediation

Upgrade past the affected range:

- `python 3.10.3`