CVE-2019-17543 LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to...
HighCVSS 8.1
EPSS 10.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lz4(Debian:12) | < 1.9.2-1 | 1.9.2-1 |
| debian/lz4(Debian:13) | < 1.9.2-1 | 1.9.2-1 |
| debian/lz4(Debian:14) | < 1.9.2-1 | 1.9.2-1 |
| alpine/lz4(Alpine:v3.10) | < 1.9.1-r1 | 1.9.1-r1 |
| alpine/lz4(Alpine:v3.11) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.12) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.13) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.14) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.15) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.16) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.17) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.18) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.19) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.20) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.21) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.22) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.23) | < 1.9.2-r0 | 1.9.2-r0 |
| alpine/lz4(Alpine:v3.24) | < 1.9.2-r0 | 1.9.2-r0 |
| Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| lz4 project lz4 | < 1.9.2 | 1.9.2 |
References
- Debian Security Tracker CVE-2019-17543 vendor-advisory
- security.alpinelinux.org vendor-advisory
- [arrow-issues] 20191024 [jira] [Created] (ARROW-6984) Update LZ4 to 1.9.2 for CVE-2019-17543 mailing-list
- [arrow-dev] 20191024 [jira] [Created] (ARROW-6984) Update LZ4 to 1.9.2 for CVE-2019-17543 mailing-list
- [arrow-issues] 20191024 [jira] [Updated] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543 mailing-list
- [arrow-issues] 20191024 [jira] [Assigned] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543 mailing-list
- [arrow-issues] 20191025 [jira] [Commented] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543 mailing-list
- openSUSE-SU-2019:2399 vendor-advisory
- openSUSE-SU-2019:2398 vendor-advisory
- [arrow-issues] 20191106 [jira] [Resolved] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543 mailing-list
- [kudu-issues] 20200621 [jira] [Updated] (KUDU-3156) Whether the CVE-2019-17543 vulnerability of lz affects kudu mailing-list
- [kudu-issues] 20200709 [jira] [Resolved] (KUDU-3156) Whether the CVE-2019-17543 vulnerability of lz affects kudu mailing-list
- www.oracle.com
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com third-party-advisory
- bugs.chromium.org third-party-advisory
- github.com third-party-advisory
- lists.apache.org
- www.oracle.com
- security.netapp.com
- cert-portal.siemens.com
- bugs.debian.org issue-tracking