GitHub Advisoryadvisory · crates.io

GHSA-9q5j-jm53-v7vr lz4-sys vulnerable to memory corruption via issue in liblz4

CRITICAL Published 2022-09-01 Modified 2022-09-01 Official page ↗
Ecosystem
crates.io
Packages
lz4-sys
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-190, CWE-787
Reviewed
2022-09-01

Affected packages

• crates.io lz4-sys: < 1.9.4 → fixed in 1.9.4

Description

lz4-sys up to v1.9.3 bundles a version of liblz4 that is vulnerable to CVE-2021-3520. Attackers could craft a payload that triggers an integer overflow upon decompression, causing an out-of-bounds write. The flaw has been corrected in version v1.9.4 of liblz4, which is included in lz4-sys 1.9.4.

Related

Weakness · CWE (2)

  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-787 Out-of-bounds Write weakness

References