109 matches found
CVE-2024-3094
CVE-2024-3094 CVE-2024-3094는 XZ 압축 라이브러리에 백도어가 포함되어 원격 SSH 액세스가 인증을 우회할 수 있게 되었습니다. 이는 Linux 시스템에 영향을 미치는 주요 공급망 공격으로, 신뢰할 수 있는 오픈 소스 구성 요소의 위험을 강조합니다. XZ 백도어: Linux 서버까지 도달하는 공급망 위협 작성자: Mark Mallia 개요 XZ 압축 라이브러리는 많은 최신 Linux 배포판의 필수 구성 요소로, 정교한 공급망 공격의 대상이 되었습니다. 악성 코드 조각이 소스 트리에 삽입되어 컴파일되었으며,...
external_zlib-1.2.7_CVE-2018-25032
ZLIB 데이터 압축 라이브러리 zlib 1.2.7은 범용 데이터 압축 라이브러리입니다. 모든 코드는 스레드 안전thread safe합니다. zlib 라이브러리에서 사용하는 데이터 형식은 RFCRequest for Comments 19501952에 설명되어 있으며, 해당 문서는 http://tools.ietf.org/html/rfc1950 zlib 형식, rfc1951 deflate 형식 및 rfc1952 gzip 형식 파일에서 확인할 수 있습니다. 압축 라이브러리의 모든 함수는 zlib.h 파일에 문서화되어 있습니다man 페...
CVE-2024-3094-analysis
CVE-2024-3094 – 실제 공급망 위협 CVE-2024-3094란 무엇인가? CVE-2024-3094는 xz 압축 라이브러리에서 발견된 주요 백도어 취약점입니다. 공격자는 이를 통해 SSH를 경유하여 원격으로 코드를 실행할 수 있습니다. 이 취약점은 의도적으로 삽입되었으며 많은 Linux 시스템의 핵심 부분에 영향을 미칩니다. 이 프로젝트는 무슨 일이 있었는지, 백도어가 어떻게 작동하는지, 보호를 위해 무엇을 할 수 있는지 이해하는 것을 목표로 합니다. CVE-2024-3094는 왜 위험한가? 이 취약점은 공격자가 보호...
Astra Linux – Vulnerability in zlib, libz-mingw-w64
Before version 1.2.12, zlib allowed memory corruption during deflation i.e., when compressing if the input contained many distant matches...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the node:zlib synchronous APIs when a spoofed TypedArray byteLength triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this...
perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob
A flaw was found in perl-IO-Compress, a component used for data compression and decompression. A remote attacker could exploit this vulnerability by crafting a malicious input, specifically an output glob, that bypasses the intended security measures. This could lead to the execution of...
[SECURITY] Fedora 44 Update: perl-Compress-Raw-Bzip2-2.218-1.fc44
This module provides a Perl interface to the bzip2 compression library. It is used by IO::Compress::Bzip2...
PT-2026-43487
Name of the Vulnerable Software and Affected Versions IO::Compress versions 2.207 through 2.219 Description The bundled zipdetails CLI tool crashes when processing an Info-ZIP Unix Extra Field tag 0x7875 where the UID Size or GID Size is set to 8. This occurs because the decode ux function trigge...
JLSEC-2026-478
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call...
JLSEC-2026-477
zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches...
CVE-2026-6535
Wireshark contains a vulnerability CVE-2026-6535 in its dissection engine where a zlib decompression crash is triggered by improper control of sequential memory allocation. Affected versions are Wireshark 4.6.0–4.6.4 and 4.4.0–4.4.14, leading to denial of service. The issue is described in the CV...
GHSA-4C3Q-X735-J3R5 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Executive Summary This report documents a critical security research finding in the compressing npm package specifically tested on the latest v2.1.0. The core vulnerability is a Partial Fix Bypass of CVE-2026-24884. The current patch relies on a purely logical string validation within the...
CVE-2026-27820
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but...
CVE-2026-27820
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but...
AZL-81800 CVE-2026-34743 affecting package xz for versions less than 5.4.4-3
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindexappend would allocate too little...
CVE-2026-34743
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindexappend would allocate too little...
CVE-2026-34743 XZ Utils: Buffer overflow in lzma_index_append()
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindexappend would allocate too little...
UBUNTU-CVE-2026-32829
lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values...
lz4_flex 安全漏洞
lz4flex is a high-performance LZ4 compression library written by PSeitz’s individual developers in the Rust language. Versions of lz4flex prior to 0.11.5 and 0.12.0 contain security vulnerabilities. These vulnerabilities stem from improper decompression of LZ4 data, leading to out-of-bounds read...