CVE-2021-3520
קריטית 9.8
תיאור (מקור, אנגלית)
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
מדדים
- CVSS 3.1
-
9.8 (CRITICAL)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 3% (אחוזון 100) נכון ל-18/10/2026
- CWE
- CWE-190, CWE-787
מוצרים מושפעים
lz4_project: lz4; netapp: active iq unified manager; netapp: cloud backup; netapp: ontap select deploy administration utility; oracle: communications cloud native core policy; oracle: zfs storage appliance kit; splunk: universal forwarder
קישורים
- https://bugzilla.redhat.com/show_bug.cgi?id=1954559 Issue TrackingPatchThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1954559 Issue TrackingPatchThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20211104-0005/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211104-0005/ Third Party Advisory