VDB
CVE-2019-11922
CVE-2019-11922
PUBLISHED
CVSS 8.100000381469727 HIGH
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
EPSS 1.42% · 72.7th percentile
Risk Scores
CVSS 3.0
8.100000381469727
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.42%
72.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | libzstd | 0, 1.3.1+dfsg-1, 1.3.2+dfsg-1 |
| Ubuntu:Pro:16.04:LTS | libzstd | 0, 0.4.5-1, 0.5.1-1 |
Timeline
- Jul 25, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 28, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 6, 2022 EPSS Score
- Jul 8, 2022 EPSS Score
- Sep 10, 2022 EPSS Score
- Jan 15, 2023 EPSS Score
References
- https://www.facebook.com/security/advisories/cve-2019-11922 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-11922 third-party-advisory
- https://ubuntu.com/security/CVE-2019-11922 advisory
- https://github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0 fix
- https://ubuntu.com/security/notices/USN-4108-1 advisory
- https://ubuntu.com/security/notices/USN-5593-1 advisory