CVE-2023-29417

An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.

• CWE-125

• https://github.com/kspalaiologos/bzip3/issues/97Exploit, Issue Tracking, Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMLFV2FJK3CM7NJLVPZI5RUAFQZICPWW/
• https://github.com/kspalaiologos/bzip3/issues/97Exploit, Issue Tracking, Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JLSE25SV7K2NB6FTFT4UHJOJUHBHYHY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA7S7HDUAINOTCSWQZ5LIW756DYY22V2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMLFV2FJK3CM7NJLVPZI5RUAFQZICPWW/

Published

Apr 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29411 A CWE-306: Missing Authentication for Critical Function vul…9.8
• CVE-2023-29412CWE-78: Improper Neutralization of Special Elements used in …9.8
• CVE-2023-29413 A CWE-306: Missing Authentication for Critical Function vul…7.5
• CVE-2023-29414 A CWE-120: Buffer Copy without Checking Size of Input (Clas…7.8
• CVE-2023-29415An issue was discovered in libbzip3.a in bzip3 before 1.3.0.…6.5
• CVE-2023-29416An issue was discovered in libbzip3.a in bzip3 before 1.3.0.…6.5
• CVE-2023-29418An issue was discovered in libbzip3.a in bzip3 before 1.2.3.…6.5
• CVE-2023-29419An issue was discovered in libbzip3.a in bzip3 before 1.2.3.…6.5
• CVE-2023-2942Improper Input Validation in GitHub repository openemr/opene…8.1
• CVE-2023-29420An issue was discovered in libbzip3.a in bzip3 before 1.2.3.…6.5
• CVE-2023-29421An issue was discovered in libbzip3.a in bzip3 before 1.2.3.…8.8
• CVE-2023-29422Missing Authorization vulnerability in AlexaCRM Dynamics 365…4.3