cve/2011/CVE-2011-4089.md

### [CVE-2011-4089](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4089)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)

### Description

The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

### POC

#### Reference
- http://seclists.org/fulldisclosure/2011/Oct/804
- http://www.exploit-db.com/exploits/18147
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632862

#### Github
- https://github.com/litneet64/containerized-bomb-disposal
Update Sun May 26 14:27:04 CEST 2024 2024-05-26 14:27:05 +02:00			`### [CVE-2011-4089](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4089)`
			`![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)`
Update CVE list 2025-09-29 21:09 2025-09-29 21:09:30 +02:00			`![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)`
Update Sun May 26 14:27:04 CEST 2024 2024-05-26 14:27:05 +02:00
			`### Description`

			`The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.`

			`### POC`

			`#### Reference`
			`- http://seclists.org/fulldisclosure/2011/Oct/804`
			`- http://www.exploit-db.com/exploits/18147`
			`- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632862`

			`#### Github`
			`- https://github.com/litneet64/containerized-bomb-disposal`