# CVE-2019-12900: Python 3.8 and 4 others: Out-of-bounds Write CVE-2019-12900 is fixed in 15 products on 2 platforms, first by bzip2 1.0.6-8.1ubuntu0.1, released June 18, 2019. 2 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2019-12900 - Priority: High - CVSS: 9.8 (Moderate) - EPSS: 0.0798 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 18, 2019 - Weakness: CWE-787: Out-of-bounds Write - Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2019-12900 ## Description BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Windows apps | Python 3.10 | 3.10.3 | [Python 3.10 3.10.3](https://patchblox.com/security/data/fix/windows-app/python.python.3.10-3.10.3.md) | Mar 16, 2022 | | Windows apps | Python 3.9 | 3.9.13 | [Python 3.9 3.9.13](https://patchblox.com/security/data/fix/windows-app/python.python.3.9-3.9.13.md) | May 17, 2022 | | Linux | bzip2 RHEL 8 | 0:1.0.6-28.el8_10 | [RHSA-2025:0733](https://patchblox.com/security/data/fix/linux/rhsa-2025-0733.md) | Jan 28, 2025 | | Linux | bzip2 RHEL 9 | 0:1.0.8-10.el9_5 | [RHSA-2025:0925](https://patchblox.com/security/data/fix/linux/rhsa-2025-0925.md) | Feb 4, 2025 | | Linux | bzip2 Ubuntu 18.04.6 LTS (bionic) | 1.0.6-8.1ubuntu0.1 | [bzip2 1.0.6-8.1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-bzip2-1.0.6-8.1ubuntu0.1.md) | Jun 18, 2019 | | Linux | bzip2 almalinux 8 | 1.0.6-28.el8_10 | [ALSA-2025:0733](https://patchblox.com/security/data/fix/linux/alsa-2025-0733.md) | Jan 28, 2025 | | Linux | bzip2 almalinux 9 | 1.0.8-10.el9_5 | [ALSA-2025:0925](https://patchblox.com/security/data/fix/linux/alsa-2025-0925.md) | Feb 4, 2025 | | Linux | bzip2 ol 8 | 0:1.0.6-27.0.1.el8_10 | [ELSA-2024-8922](https://patchblox.com/security/data/fix/linux/elsa-2024-8922.md) | Nov 11, 2024 | | Linux | bzip2 ol 9 | 0:1.0.8-10.el9_5 | [ELSA-2025-0925](https://patchblox.com/security/data/fix/linux/elsa-2025-0925.md) | Feb 3, 2025 | | Linux | bzip2 rocky 8 | 0:1.0.6-28.el8_10 | [RLSA-2025:0733](https://patchblox.com/security/data/fix/linux/rlsa-2025-0733.md) | Feb 13, 2025 | | Linux | bzip2 rocky 9 | 0:1.0.8-10.el9_5 | [RLSA-2025:0925](https://patchblox.com/security/data/fix/linux/rlsa-2025-0925.md) | Mar 17, 2025 | | Linux | bzip2-devel RHEL 8 | 0:1.0.6-28.el8_10 | [RHSA-2025:0733](https://patchblox.com/security/data/fix/linux/rhsa-2025-0733.md) | Jan 28, 2025 | | Linux | bzip2-devel RHEL 9 | 0:1.0.8-10.el9_5 | [RHSA-2025:0925](https://patchblox.com/security/data/fix/linux/rhsa-2025-0925.md) | Feb 4, 2025 | | Linux | bzip2-devel almalinux 8 | 1.0.6-28.el8_10 | [ALSA-2025:0733](https://patchblox.com/security/data/fix/linux/alsa-2025-0733.md) | Jan 28, 2025 | | Linux | bzip2-devel almalinux 9 | 1.0.8-10.el9_5 | [ALSA-2025:0925](https://patchblox.com/security/data/fix/linux/alsa-2025-0925.md) | Feb 4, 2025 | | Linux | bzip2-devel ol 8 | 0:1.0.6-27.0.1.el8_10 | [ELSA-2024-8922](https://patchblox.com/security/data/fix/linux/elsa-2024-8922.md) | Nov 11, 2024 | | Linux | bzip2-devel ol 9 | 0:1.0.8-10.el9_5 | [ELSA-2025-0925](https://patchblox.com/security/data/fix/linux/elsa-2025-0925.md) | Feb 3, 2025 | | Linux | bzip2-libs RHEL 8 | 0:1.0.6-28.el8_10 | [RHSA-2025:0733](https://patchblox.com/security/data/fix/linux/rhsa-2025-0733.md) | Jan 28, 2025 | | Linux | bzip2-libs RHEL 9 | 0:1.0.8-10.el9_5 | [RHSA-2025:0925](https://patchblox.com/security/data/fix/linux/rhsa-2025-0925.md) | Feb 4, 2025 | | Linux | bzip2-libs almalinux 8 | 1.0.6-28.el8_10 | [ALSA-2025:0733](https://patchblox.com/security/data/fix/linux/alsa-2025-0733.md) | Jan 28, 2025 | | Linux | bzip2-libs almalinux 9 | 1.0.8-10.el9_5 | [ALSA-2025:0925](https://patchblox.com/security/data/fix/linux/alsa-2025-0925.md) | Feb 4, 2025 | | Linux | bzip2-libs ol 8 | 0:1.0.6-27.0.1.el8_10 | [ELSA-2024-8922](https://patchblox.com/security/data/fix/linux/elsa-2024-8922.md) | Nov 11, 2024 | | Linux | bzip2-libs ol 9 | 0:1.0.8-10.el9_5 | [ELSA-2025-0925](https://patchblox.com/security/data/fix/linux/elsa-2025-0925.md) | Feb 3, 2025 | | Linux | clamav Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamav 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamav-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | clamav-base Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamav-base 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamav-base-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | clamav-daemon Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamav-daemon 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamav-daemon-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | clamav-docs Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamav-docs 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamav-docs-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | clamav-freshclam Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamav-freshclam 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamav-freshclam-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | clamav-milter Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamav-milter 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamav-milter-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | clamav-testfiles Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamav-testfiles 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamav-testfiles-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | clamdscan Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [clamdscan 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-clamdscan-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | | Linux | libbz2-1.0 Ubuntu 18.04.6 LTS (bionic) | 1.0.6-8.1ubuntu0.1 | [libbz2-1.0 1.0.6-8.1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libbz2-1.0-1.0.6-8.1ubuntu0.1.md) | Jun 18, 2019 | | Linux | libclamav9 Ubuntu 18.04.6 LTS (bionic) | 0.101.4+dfsg-0ubuntu0.18.04.1 | [libclamav9 0.101.4+dfsg-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libclamav9-0.101.4-dfsg-0ubuntu0.18.04.1.md) | Aug 22, 2019 | ## No fix yet | Platform | Product | Status | |---|---|---| | Windows apps | Python 3.7 | no-fix | | Windows apps | Python 3.8 | no-fix | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.