WS-2021-0625

Memcpy-param-overlap in ZSTDcreateDDict...

PT-2021-28214

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-use-after-free READ 4 crash has been reported. The crash involves the ZSTD freeDDict, blosc2 free ctx, and blosc2 schunk free functions...

openSUSE: Security Advisory for zstd (openSUSE-SU-2021:0481-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

zstd:dictionary_stream_round_trip: Use-of-uninitialized-value in ZSTD_compressBlock_lazy2_dictMatchState_row

Project: https://github.com/facebook/zstd.git Detailed Report: https://oss-fuzz.com/testcase?key=5137075566411776 Project: zstd Fuzzing Engine: libFuzzer Fuzz Target: dictionarystreamroundtrip Job Type: libfuzzermsanzstd Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cra...

zstd:stream_round_trip: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5632249312706560 Project: zstd Fuzzing Engine: libFuzzer Fuzz Target: streamroundtrip Job Type: libfuzzerasanzstd Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fa9f4e953d0 Crash State: NULL Sanitizer: address ASAN Recommended...

openSUSE Security Update : zstd (openSUSE-2021-481)

This update for zstd fixes the following issues : - CVE-2021-24031: Added read permissions to files while being compressed or uncompressed bsc1183371. - CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file bsc1183370. This update wa...

OPENSUSE-SU-2021:0481-1 Security update for zstd

This update for zstd fixes the following issues: - CVE-2021-24031: Added read permissions to files while being compressed or uncompressed bsc1183371. - CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file bsc1183370. This update was...

Security update for zstd (moderate)

openSUSE Security Update: Security update for zstd Announcement ID: openSUSE-SU-2021:0481-1 Rating: moderate References: 1183370 1183371 Cross-References: CVE-2021-24031 CVE-2021-24032 CVSS scores: CVE-2021-24031 NVD : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-24031 SUSE: 6.2...

SUSE SLED15 / SLES15 Security Update : zstd (SUSE-SU-2021:0948-1)

This update for zstd fixes the following issues : CVE-2021-24031: Added read permissions to files while being compressed or uncompressed bsc1183371. CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file bsc1183370. Note that Tenable...

SUSE-SU-2021:0948-1 Security update for zstd

This update for zstd fixes the following issues: - CVE-2021-24031: Added read permissions to files while being compressed or uncompressed bsc1183371. - CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file bsc1183370...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_execSequenceEnd

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=6055780785717248 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash...

PT-2021-28157

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-use-after-free READ crash has been identified, involving the ZSTD freeDDict, blosc2 free ctx, and blosc2 schunk free functions. Recommendations: A...

c-blosc2:decompress_frame_fuzzer: Crash in ZSTD_decompressBlock_internal

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5064975484846080 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x2580c0...

Insecure Default

Overview Affected versions of this package are vulnerable to Insecure Default. In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions matching the input would only be set at completion time. Output files could therefore ...

CVE-2021-24031

A flaw was found in zstd. While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues especially if large files are being handled...

PT-2021-28137

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ crash occurred, involving the functions ZSTD createDDict advanced, ZSTD createDDict, and blosc run decompression with context...

CVE-2021-24032

A flaw was found in zstd. While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues especially if large files are being handled...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_createDDict_advanced

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5069689706381312 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

PT-2021-28013

Name of the Vulnerable Software and Affected Versions blosc2 affected versions not specified Description The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This can lead to a crash. The error is specifically se...

PT-2021-28041

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the function names ZSTD createDDict advanced, ZSTD...