Skip to content
Fencer Intel
critical 9.8

CVE-2019-12900 json

out-of-bounds write when there are many bzip2 selectors

published 7y ago modified 26d ago also EUVD-2019-4478 , HSEC-2024-0002 , JLSEC-2025-11

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.0%
EPSS 8.0% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Patch / fix

  • hackage bzlib 0.5.2.0
  • hackage bz2 1.0.1.1
  • hackage bzlib-conduit 0.3.0.3
  • julia Bzip2_jll 1.0.7+0
  • julia Python_jll 3.10.7+0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens RUGGEDCOM ROX MX5000 V2.17.0
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.0
  • Siemens RUGGEDCOM ROX RX1400 V2.17.0
  • Siemens RUGGEDCOM ROX RX1500 V2.17.0
  • Siemens RUGGEDCOM ROX RX1501 V2.17.0
  • Siemens RUGGEDCOM ROX RX1510 V2.17.0
  • Siemens RUGGEDCOM ROX RX1511 V2.17.0
  • Siemens RUGGEDCOM ROX RX1512 V2.17.0
  • Siemens RUGGEDCOM ROX RX1524 V2.17.0
  • Siemens RUGGEDCOM ROX RX1536 V2.17.0
  • Siemens RUGGEDCOM ROX RX5000 V2.17.0
  • bzip2 Debian 14, Debian 13, Debian 12 1.0.6-9.1
  • clamav Debian 14, Debian 13, Debian 12 0.101.4+dfsg-1

debian advisories DEBIAN-CVE-2019-12900

  • bzip2 Ubuntu 16.04 LTS 1.0.6-8ubuntu0.1
  • bzip2 Ubuntu 18.04 LTS 1.0.6-8.1ubuntu0.1
  • clamav Ubuntu 16.04 LTS 0.101.4+dfsg-0ubuntu0.16.04.1
  • clamav Ubuntu 18.04 LTS 0.101.4+dfsg-0ubuntu0.18.04.1
  • bzip2 Ubuntu Pro 14.04 LTS 1.0.6-5ubuntu0.1~esm2
  • clamav Ubuntu Pro 14.04 LTS 0.101.4+dfsg-0ubuntu0.14.04.1+esm1

ubuntu advisories UBUNTU-CVE-2019-12900

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bzip2 RHEL 9 1.0.8-10.el9_5
  • bzip2-libs RHEL 9 1.0.8-10.el9_5
  • bzip2 RHEL 8 1.0.6-28.el8_10
  • bzip2-libs RHEL 8 1.0.6-28.el8_10
  • bzip2 RHEL 8 1.0.6-27.el8_10
  • bzip2-libs RHEL 8 1.0.6-27.el8_10
  • bzip2 RHEL 9.4 EUS 1.0.8-8.el9_4.1
  • bzip2-libs RHEL 9.4 EUS 1.0.8-8.el9_4.1

red hat advisories RHSA-2025:0925RHSA-2025:0733RHSA-2024:10803RHSA-2024:8922

  • clamav SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +12 more 0.103.0-33.32.1
  • clamav SLE Module for Basesystem 15 SP2, SLE Module for Basesystem 15 SP1 0.103.0-3.23.1
  • clamav SLES for SAP 12 SP5, SLES 12 SP5 0.103.0-3.3.1
  • clamav SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +13 more 0.100.3-33.26.1
  • clamav SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 0.100.3-0.20.26.1
  • clamav SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 0.100.3-3.14.1
  • bzip2 SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 1.0.5-34.256.8.1
  • bzip2 SLES 12 SP4, SLES 12 SP3-BCL, SLES 12 SP2-BCL +15 more 1.0.6-30.8.1

suse advisories SUSE-SU-2020:3918-1SUSE-SU-2020:3790-1SUSE-SU-2020:3729-1SUSE-SU-2019:3066-1SUSE-SU-2019:14231-1SUSE-SU-2019:3053-1

  • bzip2 openSUSE Tumbleweed 1.0.8-3.2
  • clamav openSUSE Tumbleweed 0.103.3-1.4
  • clamav openSUSE Leap 15.2 0.103.0-lp152.6.3.1
  • clamav openSUSE Leap 15.1 0.103.0-lp151.2.12.1
  • clamav openSUSE Leap 15.0 0.100.3-lp150.2.13.1
  • clamav openSUSE Leap 15.1 0.100.3-lp151.2.3.1
  • bzip2 openSUSE Leap 15.1, openSUSE Leap 15.0 1.0.6-lp151.5.9.1
  • bzip2 openSUSE Leap 15.1, openSUSE Leap 15.0 1.0.6-lp151.5.6.1

opensuse advisories openSUSE-SU-2024:10667-1openSUSE-SU-2024:10685-1openSUSE-SU-2020:2276-1openSUSE-SU-2020:2268-1openSUSE-SU-2019:2597-1openSUSE-SU-2019:2595-1

  • bzip2 AlmaLinux 9 1.0.8-10.el9_5
  • bzip2-libs AlmaLinux 9 1.0.8-10.el9_5
  • bzip2 AlmaLinux 8 1.0.6-28.el8_10
  • bzip2-libs AlmaLinux 8 1.0.6-28.el8_10
  • bzip2 AlmaLinux 8 1.0.6-27.el8_10
  • bzip2-libs AlmaLinux 8 1.0.6-27.el8_10

almalinux advisories ALSA-2025:0925ALSA-2025:0733ALSA-2024:8922

  • bzip2 Rocky Linux 9 1.0.8-10.el9_5
  • bzip2 Rocky Linux 8 1.0.6-28.el8_10
  • bzip2 Rocky Linux 8 1.0.6-27.el8_10

rocky linux advisories RLSA-2025:0925RLSA-2025:0733RLSA-2024:8922

  • bzip2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 1.0.6-r7

alpine advisories ALPINE-CVE-2019-12900

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2019-12900 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-12900 updated cvss 4.4

bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail).

  • Red Hat Enterprise Linux 7 bzip2, bzip2-libs
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 9) bzip2-devel 1.0.8-10.el9_5, bzip2-debuginfo 1.0.8-10.el9_5, bzip2-debugsource 1.0.8-10.el9_5, bzip2-libs-debuginfo 1.0.8-10.el9_5
    fixed: vendor fix RHSA-2025:0925
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) bzip2-devel 1.0.8-8.el9_4.1, bzip2-debuginfo 1.0.8-8.el9_4.1, bzip2-debugsource 1.0.8-8.el9_4.1, bzip2-libs-debuginfo 1.0.8-8.el9_4.1
    fixed: vendor fix RHSA-2024:10803
  • Red Hat Enterprise Linux BaseOS (v. 8) bzip2 1.0.6-27.el8_10, bzip2 1.0.6-28.el8_10, bzip2-libs 1.0.6-27.el8_10, bzip2-libs 1.0.6-28.el8_10
    fixed: vendor fix RHSA-2024:8922
  • Red Hat Enterprise Linux BaseOS (v. 9) bzip2 1.0.8-10.el9_5, bzip2-libs 1.0.8-10.el9_5
    fixed: vendor fix RHSA-2025:0925
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bzip2 1.0.8-8.el9_4.1, bzip2-libs 1.0.8-8.el9_4.1
    fixed: vendor fix RHSA-2024:10803
  • Red Hat RHINT Camel-K 1.10.9
    fixed: vendor fix RHSA-2025:1154
  • Red Hat Enterprise Linux 10 bzip2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 9.8

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
last yr.

Exploit prediction

7.98% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.0 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
hackage bzlib
>=0.4, <0.5.2.0
0.5.2.0
hackage bz2
>=0.1.0.0, <1.0.1.1
1.0.1.1
hackage bzlib-conduit
>=0.1.0.0, <0.3.0.3
0.3.0.3
julia Bzip2_jll
<1.0.7+0
1.0.7+0
julia Python_jll
<3.10.7+0
3.10.7+0

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.