CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2021-3520 – lz4: memory corruption due to an integer overflow bug caused by memmove argument
https://notcve.org/view.php?id=CVE-2021-3520
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well. Se presenta un fallo en lz4. Un atacante que envíe un archivo diseñado hacia una aplicación enlazada con lz4 puede ser capaz de desencadenar un desbordamiento de enteros, conllevando una llamada de la función memmove() con un argumento de tamaño negativo, causando una escritura fuera de límites y/o un bloqueo. • https://bugzilla.redhat.com/show_bug.cgi?id=1954559 https://security.netapp.com/advisory/ntap-20211104-0005 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpuoct2021.html https://access.redhat.com/security/cve/CVE-2021-3520 • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17543
https://notcve.org/view.php?id=CVE-2019-17543
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk." LZ4 versiones anteriores a 1.9.2, presenta un desbordamiento de búfer en la región heap de la memoria en LZ4_write32 (relacionado con la función LZ4_compress_destSize), que afecta a las aplicaciones que llaman a LZ4_compress_fast con una entrada larga. (Este problema también puede conllevar a la corrupción de datos). • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941 https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2 https://github.com/lz4/lz4/issues/801 https://github.com/lz4/lz4/pull/756 https://github.com/lz4/lz4/pull/760 https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17%40%3Cissues.arrow&# • CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4715
https://notcve.org/view.php?id=CVE-2014-4715
Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run, a different vulnerability than CVE-2014-4611. Yann Collet LZ4 anterior a r119, cuando se utiliza en cierta plataformas de 32-bits que asigna memoria más allá de 0x80000000, no detecta correctamente desbordamientos de enteros, lo que permite a atacantes dependientes de contexto causar una denegación de servicio (corrupción de memoria) o posiblemente tener otro impacto no especificado a través de un 'Literal Run' manipulado, una vulnerabilidad diferente a CVE-2014-4611. • http://blog.securitymouse.com/2014/07/i-was-wrong-proving-lz4-exploitable.html http://fastcompression.blogspot.fr/2014/07/software-vulnerabilities-how-it-works.html http://secunia.com/advisories/59770 https://code.google.com/p/lz4/issues/detail?id=134 https://code.google.com/p/lz4/source/detail?r=119 • CWE-189: Numeric Errors •