PT-2018-10613 · Lrzip +1 · Long Range Zip +1

Name of the Vulnerable Software and Affected Versions: Long Range Zip aka lrzip version 0.631 Description: The issue is related to a use-after-free in the read stream function in stream.c, caused by the lack of certain size validation in the decompress file function in lrzip.c. Recommendations: F...

PT-2018-10614

Name of the Vulnerable Software and Affected Versions Lizard version 1.0 LZ5 version 2.0 Description The issue is related to an unchecked buffer size during a memcpy in the Lizard decompress LIZv1 function, located in lib/lizard decompress liz.h. This allows remote attackers to cause a denial of...

Long Range Zip 'lzma_decompress_buf' function memory misreference vulnerability

Long Range Zip aka lrzip is an open source compression utility for large files. A memory misreference vulnerability exists in the 'lzmadecompressbuf' function in the stream.c file in Long Range Zip version 0.631. A remote attacker could exploit this vulnerability to cause a denial of service...

CVE-2018-10685

In Long Range Zip aka lrzip 0.631, there is a use-after-free in the lzmadecompressbuf function of stream.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

DEBIAN-CVE-2018-10685

In Long Range Zip aka lrzip 0.631, there is a use-after-free in the lzmadecompressbuf function of stream.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

PT-2018-10052

Name of the Vulnerable Software and Affected Versions Long Range Zip aka lrzip version 0.631 Description The issue is related to a use-after-free in the lzma decompress buf function of stream.c, allowing remote attackers to cause a denial of service, such as an application crash, or possibly have...

CVE-2017-2693

ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier versions,ALE-L23C605B190 and earlier...

CVE-2017-2693

ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier versions,ALE-L23C605B190 and earlier...

CVE-2017-15873

The getnextblock function in archival/libarchive/decompressbunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation...

ALPINE-CVE-2017-15874

archival/libarchive/decompressunlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation...

CVE-2017-15874

archival/libarchive/decompressunlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation...

PT-2017-4121

Name of the Vulnerable Software and Affected Versions BusyBox version 1.27.2 Description The issue is related to an Integer Overflow in the get next block function, located in the archival/libarchive/decompress bunzip2.c component of BusyBox. This overflow may lead to a write access violation. Th...

librawspeed: Use-after-poison in rawspeed::NikonDecompressor::decompress

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5062035266076672 Project: librawspeed Fuzzer: afllibrawspeedTiffDecoderFuzzer-NefDecoder Fuzz target binary: TiffDecoderFuzzer-NefDecoder Job Type: aflasanlibrawspeed Platform Id: linux Crash...

OpenJPEG Denial of Service Vulnerability (CNVD-2017-27279)

OpenJPEG is a C-based open source JPEG 2000 codec . A denial of service vulnerability exists in the opjdecompress component of OpenJPEG, which could be exploited by a remote attacker to conduct a denial of service attack or remotely execute arbitrary code by constructing a specially crafted J2k...

Amazon Linux AMI : graphite2 (ALAS-2017-872)

Vulnerabilities in the Graphite 2 library MFSA 2017-16 A heap-based buffer overflow flaw related to 'lz4::decompress' has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code. CVE-2017-7778 Heap-buffer-overflow write...

librawspeed: Use-after-poison in rawspeed::PentaxDecompressor::decompress

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6284277756985344 Project: librawspeed Fuzzer: libFuzzerlibrawspeedTiffDecoderFuzzer-PefDecoder Fuzz target binary: TiffDecoderFuzzer-PefDecoder Job Type: libfuzzerasanlibrawspeed Platform Id:...

shoco API 'shoco_decompress' function denial of service vulnerability

shoco is a C language library for string compression, of which the API is a programming interface. A security vulnerability exists in the 'shocodecompress' function of the API in shoco 2017-07-17 and earlier versions. A remote attacker can exploit this vulnerability with malformed compressed data...

PT-2017-11962

Name of the Vulnerable Software and Affected Versions shoco through 2017-07-17 Description The issue allows remote attackers to cause a denial of service, resulting in a buffer over-read and application crash, via malformed compressed data. This is related to the shoco decompress function in the...

gdal: Heap-buffer-overflow in LercNS::RLE::decompress

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4726197688729600 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x62a0000119...

gdal: Heap-buffer-overflow in LercNS::RLE::decompress

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5114295765434368 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...