Lucene search

K
redosRedosROS-20240607-03
HistoryJun 07, 2024 - 12:00 a.m.

ROS-20240607-03

2024-06-0700:00:00
redos.red-soft.ru
8
irzip software
buffer overflow
dynamic memory
vulnerability
remote attacker
confidentiality
integrity
availability
denial of service
unix
zpaq_decompress_buf()
layerar_rulist()

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

46.3%

A vulnerability in the lrzip.c:initialize_control component of the Irzip software tool is caused by a buffer overflow in dynamic memory.
buffer overflow in dynamic memory. Exploitation of the vulnerability could allow an attacker acting remotely,
affect confidentiality, integrity and availability of protected information

Vulnerability of zpaq_decompress_buf() and layerar_rulist() functions of Irzip software tool is related to
parallel use of memory after release between functions zpaq_decompress_buf() and
islear_rulist() Exploitation of the vulnerability could allow an attacker to cause a denial of service

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64lrzip< 0.651-1UNKNOWN

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

46.3%