Unscored severity · published Aug 12, 2002
CVE-2002-0761
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an…
–
CVSS
0.4%
EPSS
No
On KEV
Description
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BZ
Bzip2 · Bzip
0.9.0; 0.9.0a; 0.9.0b; 0.9.0c; 0.9.5a; 0.9.5b; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0761
Patch
http://www.iss.net/security_center/static/9128.php
Patch
http://www.securityfocus.com/bid/4776
More from Bzip2
9.8
CVE-2019-12900
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors
6.5
CVE-2016-3189
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to…
–
CVE-2011-4089
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute…
–
CVE-2010-0405
Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application…
–
CVE-2008-1372
bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by…