There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2021-06-02T12:32:32

Updated: 2024-08-03T17:01:07.870Z

Reserved: 2021-04-28T00:00:00

Link: CVE-2021-3520

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-06-02T13:15:13.170

Modified: 2024-11-21T06:21:44.987

Link: CVE-2021-3520

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-04-28T00:00:00Z

Links: CVE-2021-3520 - Bugzilla