CVE-2002-0761 bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could c...
LowCVSS 2.1
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bzip2 | = 0.9.0 | No fix listed |
| bzip2 | = 0.9.0a | No fix listed |
| bzip2 | = 0.9.0b | No fix listed |
| bzip2 | = 0.9.0c | No fix listed |
| bzip2 | = 0.9.5a | No fix listed |
| bzip2 | = 0.9.5b | No fix listed |
| bzip2 | = 0.9.5c | No fix listed |
| bzip2 | = 0.9.5d | No fix listed |
| bzip2 | = 1.0 | No fix listed |
| bzip2 | = 1.0.1 | No fix listed |
References
- bzip2-compression-symlink(9128) patch vdb-entry vendor-advisory
- 4776 patch vdb-entry vendor-advisory