CVE-2011-4089 | BDVDB-2026-60980 Detail

Description#

The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://seclists.org/fulldisclosure/2011/Oct/804
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632862
http://www.ubuntu.com/usn/USN-1308-1
http://www.exploit-db.com/exploits/18147
http://www.openwall.com/lists/oss-security/2011/10/28/16

Exploit#

http://www.exploit-db.com/exploits/18147

History#

Version 12014-04-16Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.