CVE-2021-3520

01/תיאור (מקור, אנגלית)

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

02/מוצרים מושפעים

lz4_project: lz4; netapp: active iq unified manager; netapp: cloud backup; netapp: ontap select deploy administration utility; oracle: communications cloud native core policy; oracle: zfs storage appliance kit; splunk: universal forwarder

03/קישורים10

• bugzilla.redhat.com/show_bug.cgi?id=1954559 Issue TrackingPatchThird Party Advisory
• www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• bugzilla.redhat.com/show_bug.cgi?id=1954559 Issue TrackingPatchThird Party Advisory
• www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• security.netapp.com/advisory/ntap-20211104-0005/ Third Party Advisory
• security.netapp.com/advisory/ntap-20211104-0005/ Third Party Advisory