CVE catalog

CVE-2009-1884

libcompress-raw-bzip2-perl: CVE-2009-1884

[CVE catalog]

Severity
High
Published
Source
[NVD] · [CVE record]
EPSS
2.59% · Oct 25, 2026

Off-by-one error in the bzinflate function in Bzip2.xs in the Compress-Raw-Bzip2 module before 2.018 for Perl allows context-dependent attackers to cause a denial of service (application hang or crash) via a crafted bzip2 compressed stream that triggers a buffer overflow, a related issue to CVE-2009-1391.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcompress-raw-bzip2-perlsid2.225-1fixed
Debianlibcompress-raw-bzip2-perlforky2.225-1fixed
Debianlibcompress-raw-bzip2-perltrixie2.213-2fixed
Debianlibcompress-raw-bzip2-perlbookworm2.204-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcompress-raw-bzip2-perlsourcesid2.018-1mediumNot reported[542777]
Debianlibcompress-raw-bzip2-perlsourceforky2.018-1mediumNot reported[542777]
Debianlibcompress-raw-bzip2-perlsourcetrixie2.018-1mediumNot reported[542777]
Debianlibcompress-raw-bzip2-perlsourcebookworm2.018-1mediumNot reported[542777]

[Debian bug #542777]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcompress-raw-bzip2-perl]Fixed
    Details (2)

    • 2.204-1 · amd64 · bookworm

      Fixed · Fixed: 2.018-1

      dsa · libcompress-raw-bzip2-perl · debian · bookworm; dsa · libcompress-raw-bzip2-perl · debian · 12

    • 2.204-1 · arm64 · bookworm

      Fixed · Fixed: 2.018-1

      dsa · libcompress-raw-bzip2-perl · debian · bookworm; dsa · libcompress-raw-bzip2-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcompress-raw-bzip2-perl]Fixed
    Details (2)

    • 2.213-2 · amd64 · trixie

      Fixed · Fixed: 2.018-1

      dsa · libcompress-raw-bzip2-perl · debian · 13

    • 2.213-2 · arm64 · trixie

      Fixed · Fixed: 2.018-1

      dsa · libcompress-raw-bzip2-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]