QSN-8685-1: bzip2 vulnerability
2026-08-27

Summary:
bzip2 could be made to crash if it processed a specially crafted archive.

Details:
It was discovered that bzip2 did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a crash,
resulting in a denial of service.

Affected QuantaStor releases:
  6.9.1.001 jammy: bzip2 1.0.8-5ubuntu0.1 (fixed in 1.0.8-5ubuntu0.1)
  6.9.1.001 jammy: libbz2-1.0 1.0.8-5ubuntu0.1 (fixed in 1.0.8-5ubuntu0.1)
  6.9.0.464 jammy: bzip2 1.0.8-5ubuntu0.1 (fixed in 1.0.8-5ubuntu0.1)
  6.9.0.464 jammy: libbz2-1.0 1.0.8-5ubuntu0.1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.6.015 jammy: bzip2 1.0.8-5ubuntu0.1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.6.015 jammy: libbz2-1.0 1.0.8-5ubuntu0.1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.5.018 jammy: bzip2 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.5.018 jammy: libbz2-1.0 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.4.038 jammy: bzip2 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.4.038 jammy: libbz2-1.0 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.3.018 jammy: bzip2 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.3.018 jammy: libbz2-1.0 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.2.002 jammy: bzip2 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.2.002 jammy: libbz2-1.0 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.1.007 jammy: bzip2 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.1.007 jammy: libbz2-1.0 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.0.205 jammy: bzip2 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)
  6.8.0.205 jammy: libbz2-1.0 1.0.8-5build1 (fixed in 1.0.8-5ubuntu0.1)

CVEs: CVE-2026-42250

References:
  https://ubuntu.com/security/notices/USN-8685-1