CVE-2019-11922

CVE-2019-11922 is supported by multiple connected advisories detailing a race condition in Zstandard (zstd) one-pass compression prior to version 1.3.8. The issue allows potential out-of-bounds writes when an output buffer smaller than the recommended size is used. Affected software is the zstd i...

CVE-2021-24032

CVE-2021-24032 affects the Zstandard command-line utility (zstd). In versions before v1.4.9, starting with v1.4.1, an incomplete fix for CVE-2021-24031 caused output files to be created with default permissions and only later restricted, making them momentarily readable/writable by unintended par...

CVE-2022-4899

CVE-2022-4899 affects zstd up to v1.4.10, enabling a buffer overrun when an empty string is supplied as an argument to the zstd command line tool. Astra Linux and Amazon Linux advisories confirm the issue and provide patched packages (e.g., zstd 1.5.x) as remediation. If exploited, impact pertain...

CVE-2021-24031

CVE-2021-24031 is discussed in the connected IBM security bulletin as part of a broader set of vulnerabilities. The Zstandard command-line utility prior to v1.4.1 creates output files with default permissions and only sets the correct permissions at completion time, potentially making outputs rea...