OESA-2021-1245

Dashboard / Vulnerabilities / OESA-2021-1245

OESA-2021-1245

Summary: lz4 security update

Details: LZ4 is lossless compression algorithm, providing compression speed > 500 MB/s per core (>0.15 Bytes/cycle). It features an extremely fast decoder, with speed in multiple GB/s per core (~1 Byte/cycle). A high compression derivative, called LZ4_HC, is available, trading customizable CPU time for compression ratio. Security Fix(es): There s a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.(CVE-2021-3520)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1245, https://nvd.nist.gov/vuln/detail/CVE-2021-3520