Arch Linux Security Advisory ASA-201702-19 ========================================== Severity: Low Date : 2017-02-22 CVE-ID : CVE-2016-3189 Package : bzip2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-4 Summary ======= The package bzip2 before version 1.0.6-6 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.6-6. # pacman -Syu "bzip2>=1.0.6-6" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A use-after-free flaw was found in bzip2recover, leading to a null pointer dereference, or a write to a closed file descriptor. An attacker could use this flaw by sending a specially crafted bzip2 file to recover and force the program to crash. Impact ====== An attacker is able to create a specially crafted bzip2 archive that, when processed by bzip2recover, crashes the process resulting in denial of service. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1319648 https://security.archlinux.org/CVE-2016-3189