logo
DATABASE RESOURCES PRICING ABOUT US

CVE-2021-3520

Description

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.


Affected Package


OS OS Version Package Name Package Version
Debian 12 lz4 1.9.4-1
Debian 11 lz4 1.9.3-2
Debian 10 lz4 1.8.3-1+deb10u1
Debian 999 lz4 1.9.4-1

Related