CVE-2011-4089

2014-04-1618:37:11

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

Low

EPSS

Percentile

13.1%

JSON

The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

Affected configurations

Nvd

Node

bzipbzip2Range≤1.0.4

bzipbzip2Match1.0

bzipbzip2Match1.0.1

bzipbzip2Match1.0.2

bzipbzip2Match1.0.3

VendorProductVersionCPE
bzipbzip2*cpe:2.3:a:bzip:bzip2:*:*:*:*:*:*:*:*
bzipbzip21.0cpe:2.3:a:bzip:bzip2:1.0:*:*:*:*:*:*:*
bzipbzip21.0.1cpe:2.3:a:bzip:bzip2:1.0.1:*:*:*:*:*:*:*
bzipbzip21.0.2cpe:2.3:a:bzip:bzip2:1.0.2:*:*:*:*:*:*:*
bzipbzip21.0.3cpe:2.3:a:bzip:bzip2:1.0.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bzip	bzip2	*	cpe:2.3:a:bzip:bzip2::::::::
bzip	bzip2	1.0	cpe:2.3:a:bzip:bzip2:1.0:::::::*
bzip	bzip2	1.0.1	cpe:2.3:a:bzip:bzip2:1.0.1:::::::*
bzip	bzip2	1.0.2	cpe:2.3:a:bzip:bzip2:1.0.2:::::::*
bzip	bzip2	1.0.3	cpe:2.3:a:bzip:bzip2:1.0.3:::::::*