Vulnetix
Try Vulnetix Request Demo
ALPINE-CVE-2019-17543 PUBLISHED CVSS 8.100000381469727 HIGH

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Risk Scores

CVSS v3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Alpine:v3.16lz41.7.5-r0, 1.8.0-r0, 1.8.0-r1
Alpine:v3.15lz41.8.0-r0, 0, 1.9.1-r0
Alpine:v3.19lz41.7.5-r0, 1.9.1-r0, 1.8.3-r2
Alpine:v3.17lz40, 1.7.5-r0, 1.8.0-r0
Alpine:v3.10lz40, 1.7.5-r0, 1.8.0-r0
Alpine:v3.21lz41.8.1.2-r0, 0, 1.7.5-r0
Alpine:v3.11lz41.8.1.2-r0, 1.8.0-r0, 1.8.0-r1
Alpine:v3.13lz41.7.5-r0, 1.9.1-r0, 1.8.3-r2
Alpine:v3.23lz41.8.1-r0, 1.8.3-r2, 1.8.3-r1
Alpine:v3.20lz40, 1.7.5-r0, 1.8.0-r0
Alpine:v3.12lz41.7.5-r0, 1.8.0-r0, 1.8.0-r1
Alpine:v3.18lz40, 1.7.5-r0, 1.8.0-r0
Alpine:v3.22lz41.9.1-r0, 1.8.3-r2, 1.8.3-r1
Alpine:v3.14lz40, 1.9.1-r0, 1.8.3-r2

Timeline

References

Open in Interactive Console →