CVE-2021-3520
CRITICAL9.8EPSS 0.14%Memory corruption in liblz4
發布日:2022/8/25修改日:2026/4/28
描述
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
受影響套件(5)
- Alpine/lz4from 0, < 1.9.2-r1
- crates.io/lz4-sys>= 0.0.0-0, < 1.9.4
- Debian/lz4from 0, < 1.9.3-2
- Debian/lz4from 0, < 0.0~r131-2+deb9u1
- Debian/lz4from 0, < 1.8.3-1+deb10u1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |