DEBIAN-CVE-2018-11496

In Long Range Zip aka lrzip 0.631, there is a use-after-free in readstream in stream.c, because decompressfile in lrzip.c lacks certain size validation...

PT-2018-10613 · Lrzip +1 · Long Range Zip +1

Name of the Vulnerable Software and Affected Versions: Long Range Zip aka lrzip version 0.631 Description: The issue is related to a use-after-free in the read stream function in stream.c, caused by the lack of certain size validation in the decompress file function in lrzip.c. Recommendations: F...

Long Range Zip 'lzma_decompress_buf' function memory misreference vulnerability

Long Range Zip aka lrzip is an open source compression utility for large files. A memory misreference vulnerability exists in the 'lzmadecompressbuf' function in the stream.c file in Long Range Zip version 0.631. A remote attacker could exploit this vulnerability to cause a denial of service...

CVE-2018-10685

In Long Range Zip aka lrzip 0.631, there is a use-after-free in the lzmadecompressbuf function of stream.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

DEBIAN-CVE-2018-10685

In Long Range Zip aka lrzip 0.631, there is a use-after-free in the lzmadecompressbuf function of stream.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

CVE-2017-2693

ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier versions,ALE-L23C605B190 and earlier...

CVE-2017-2693

ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier versions,ALE-L23C605B190 and earlier...

ALPINE-CVE-2017-15874

archival/libarchive/decompressunlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation...

CVE-2017-15873

The getnextblock function in archival/libarchive/decompressbunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation...

CVE-2017-15874

archival/libarchive/decompressunlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation...

librawspeed: Use-after-poison in rawspeed::NikonDecompressor::decompress

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5062035266076672 Project: librawspeed Fuzzer: afllibrawspeedTiffDecoderFuzzer-NefDecoder Fuzz target binary: TiffDecoderFuzzer-NefDecoder Job Type: aflasanlibrawspeed Platform Id: linux Crash...

OpenJPEG Denial of Service Vulnerability (CNVD-2017-27279)

OpenJPEG is a C-based open source JPEG 2000 codec . A denial of service vulnerability exists in the opjdecompress component of OpenJPEG, which could be exploited by a remote attacker to conduct a denial of service attack or remotely execute arbitrary code by constructing a specially crafted J2k...

Amazon Linux AMI : graphite2 (ALAS-2017-872)

Vulnerabilities in the Graphite 2 library MFSA 2017-16 A heap-based buffer overflow flaw related to 'lz4::decompress' has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code. CVE-2017-7778 Heap-buffer-overflow write...

librawspeed: Use-after-poison in rawspeed::PentaxDecompressor::decompress

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6284277756985344 Project: librawspeed Fuzzer: libFuzzerlibrawspeedTiffDecoderFuzzer-PefDecoder Fuzz target binary: TiffDecoderFuzzer-PefDecoder Job Type: libfuzzerasanlibrawspeed Platform Id:...

shoco API 'shoco_decompress' function denial of service vulnerability

shoco is a C language library for string compression, of which the API is a programming interface. A security vulnerability exists in the 'shocodecompress' function of the API in shoco 2017-07-17 and earlier versions. A remote attacker can exploit this vulnerability with malformed compressed data...

gdal: Heap-buffer-overflow in LercNS::RLE::decompress

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4726197688729600 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x62a0000119...

gdal: Heap-buffer-overflow in LercNS::RLE::decompress

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5114295765434368 Project: gdal Fuzzer: libFuzzergdalfuzzer Fuzz target binary: gdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

gdal: Heap-buffer-overflow in bool LercNS::Lerc2::ReadDataOneSweep<unsigned char>

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6063691910873088 Project: gdal Fuzzer: libFuzzergdalfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x607000001176 Crash State: bool...

graphite2: heap-buffer-overflow write "lz4::decompress" (CVE-2017-7772)

A heap-based buffer overflow flaw related to "lz4::decompress" has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code...

CVE-2017-7772

A heap-based buffer overflow flaw related to "lz4::decompress" has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code...