Input validation error in abiword (Alpine package)

1) Input validation error

EUVDB-ID: #VU33981

Risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2010-0405

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

Mitigation

Install update from vendor's website.

Vulnerable software versions

dovecot (Alpine package): 1.2.13-r1

CPE2.3

• cpe:2.3:o:alpine:dovecot_alpine_package:1.2.13-r1:*:*:*:*:alpine_linux:*:

External links

http://git.alpinelinux.org/aports/commit/?id=1960a2d07dbf3a3e1ddc7fb7c8763889a049d33a
http://git.alpinelinux.org/aports/commit/?id=c70abd8a9cf8aac3f47765ea5f3c61e397a5bd63
http://git.alpinelinux.org/aports/commit/?id=cc2aa424d31413a8a21bebfd5638206cf00266e7
http://git.alpinelinux.org/aports/commit/?id=0c5c85d46e40eabb6c4d5a6574e8e934a3bb39a8
http://git.alpinelinux.org/aports/commit/?id=0e87d7f6a630338b83b49ab147cddc879d911d43
http://git.alpinelinux.org/aports/commit/?id=4315c802e81b76b5943f4cb7f6e182ab479a55d3
http://git.alpinelinux.org/aports/commit/?id=5636a85b81a5da9edd1ba98293eab9ee2b3e9890
http://git.alpinelinux.org/aports/commit/?id=81bef34128ab2e7c7202ceb7e59f533d1192bdd8
http://git.alpinelinux.org/aports/commit/?id=b3bfcf0314b9ec6de3e5285326fab57b0ecf669f
http://git.alpinelinux.org/aports/commit/?id=b5cf3318e044512443a0fa0e10cb982f59da2761
http://git.alpinelinux.org/aports/commit/?id=78aed5d7c9fd9bbc1846636d609eddf50e18bd98
http://git.alpinelinux.org/aports/commit/?id=970b14c3acd3c0dfc3e7bfc11f65d4f8c83cf152
http://git.alpinelinux.org/aports/commit/?id=2993bf8ebd253d3c87549d3cbc2493dc263b875f
http://git.alpinelinux.org/aports/commit/?id=2ba47c8dcc35b91b67f226078a86b999045515ff
http://git.alpinelinux.org/aports/commit/?id=39ea74e2689d73eee0f560b7f9353839d4439677
http://git.alpinelinux.org/aports/commit/?id=3fecb419994eaebdbeb6d88e97df14817f4d23e2
http://git.alpinelinux.org/aports/commit/?id=9a67cfdd9c2dbb205135ef461c7041b14fdc54c2
http://git.alpinelinux.org/aports/commit/?id=a2ef784afd6e6caed7673f6793445c9abb71d3eb
http://git.alpinelinux.org/aports/commit/?id=3b4fae1625ae3a0c78b42a956a76217bfed5b628
http://git.alpinelinux.org/aports/commit/?id=ec96d060ea1a6925584b30dd26913fc3c5b43825
http://git.alpinelinux.org/aports/commit/?id=6ce8104d7e30467737f2ea55a5ad4666779f3a58
http://git.alpinelinux.org/aports/commit/?id=82075d557c24cad14a2c6efe405217d9e3819ee1
http://git.alpinelinux.org/aports/commit/?id=2a1d88e40c2d5c6641847f117043bfc8f15eb06c
http://git.alpinelinux.org/aports/commit/?id=d34a4c69f3b06ba0712024bdf523bbe42368402e
http://git.alpinelinux.org/aports/commit/?id=a2a7a31a010a9d38fcb087f806a9da135b128988
http://git.alpinelinux.org/aports/commit/?id=69359729649b58c774626ffe0a17524cbe59a062
http://git.alpinelinux.org/aports/commit/?id=1fc00617dd490a256410e9b402c1eb1a3854a169
http://git.alpinelinux.org/aports/commit/?id=9ee36dee85e40a53eef6ce31da1984abec51ac09
http://git.alpinelinux.org/aports/commit/?id=b9fa573742f5ae217feec4c1e2c1a85361360f6c
http://git.alpinelinux.org/aports/commit/?id=8c6ac9aaffb9999783dff8a492207b382e26cb93
http://git.alpinelinux.org/aports/commit/?id=91e65d665357e34d3ca951a324c0a497040288de
http://git.alpinelinux.org/aports/commit/?id=0ca00136b0cc5a106ed610588cb90e7ee68f0368
http://git.alpinelinux.org/aports/commit/?id=0bdb7af7fb087d0c0d6f005b6d0054a951861b18
http://git.alpinelinux.org/aports/commit/?id=702d100a5c7196ca38003c430e7efb83f48d5a64
http://git.alpinelinux.org/aports/commit/?id=fba31e0d823349c01bdbaf30d42508d2fb384faf
http://git.alpinelinux.org/aports/commit/?id=1b7a989a8a8e1ce2bef83fb1f9f2488254ac5d75
http://git.alpinelinux.org/aports/commit/?id=36160e4feabe3f21af2d8a4259c77aa789c345fa

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.