Buffer overflow in Lz4 Project
CVE-2019-17543
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.105 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.091 · newest: 0.105 · change: +0.013
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c… (mailing-list)
- lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0de… (mailing-list)
- lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d754120… (mailing-list)
- lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87… (mailing-list)
- lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50… (mailing-list)
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html (vendor-advisory)
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html (vendor-advisory)
- lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be340… (mailing-list)
- lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff… (mailing-list)
- lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c190… (mailing-list)
Frequently asked questions
- What is CVE-2019-17543?
- CVE-2019-17543 is a high-severity vulnerability in Lz4 Project, classified under Out-of-bounds Write. CVSS score: 8.1/10. Published 2019-10-14.
- How severe is CVE-2019-17543?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2019-17543 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.