c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_execSequenceEnd

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=6055780785717248 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash...

PT-2021-28157

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-use-after-free READ crash has been identified, involving the ZSTD freeDDict, blosc2 free ctx, and blosc2 schunk free functions. Recommendations: A...

c-blosc2:decompress_frame_fuzzer: Crash in ZSTD_decompressBlock_internal

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5064975484846080 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x2580c0...

Insecure Default

Overview Affected versions of this package are vulnerable to Insecure Default. In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions matching the input would only be set at completion time. Output files could therefore ...

CVE-2021-24031

A flaw was found in zstd. While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues especially if large files are being handled...

PT-2021-28137

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ crash occurred, involving the functions ZSTD createDDict advanced, ZSTD createDDict, and blosc run decompression with context...

CVE-2021-24032

A flaw was found in zstd. While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues especially if large files are being handled...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_createDDict_advanced

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5069689706381312 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

PT-2021-28013

Name of the Vulnerable Software and Affected Versions blosc2 affected versions not specified Description The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This can lead to a crash. The error is specifically se...

PT-2021-28041

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the function names ZSTD createDDict advanced, ZSTD...

Fedora 32 : xen (2020-4ff32ef9be)

stack corruption from XSA-346 change XSA-355 ---- support zstd compressed kernels dom0 only based on linux kernel code Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

zstd bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

ALBA-2020:4557 zstd bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

zstd bug fix and enhancement update

An update is available for zstd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

OSV-2020-1060 Use-of-uninitialized-value in ZSTD_createDDict_advanced

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23732 Crash type: Use-of-uninitialized-value Crash state: ZSTDcreateDDictadvanced ZSTDcreateDDict bloscrundecompressionwithcontext...

PT-2020-21679

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the ZSTD createDDict advanced and ZSTD createDDict...

SUSE SLED15 / SLES15 Security Update : zstd (SUSE-SU-2020:1396-2)

This update for zstd fixes the following issues : Fix for build error caused by wrong static libraries. bsc1133297 Correction in spec file marking the license as documentation. bsc1082318 Add new package for SLE-15. jscECO-1886 Note that Tenable Network Security has extracted the preceding...

SUSE-SU-2020:1396-1 Security update for zstd

This update for zstd fixes the following issues: - Fix for build error caused by wrong static libraries. bsc1133297 - Correction in spec file marking the license as documentation. bsc1082318 - Add new package for SLE-15. jscECO-1886...

SUSE-SU-2020:1396-3 Security update for zstd

This update for zstd fixes the following issues: - Fix for build error caused by wrong static libraries. bsc1133297 - Correction in spec file marking the license as documentation. bsc1082318 - Add new package for SLE-15. jscECO-1886...

SUSE-SU-2020:1396-2 Security update for zstd

This update for zstd fixes the following issues: - Fix for build error caused by wrong static libraries. bsc1133297 - Correction in spec file marking the license as documentation. bsc1082318 - Add new package for SLE-15. jscECO-1886...