PT-2014-2057 · Yann Collet+1 · Lz4+1

Published 2014-07-01 · Updated 2021-09-28 · CVE-2014-4715

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions LZ4 versions prior to r119

Description The issue is related to errors in number processing in the LZ4 lossless data compression algorithm. It may allow a remote attacker to cause a denial of service, potentially through memory corruption, by exploiting the vulnerability with a crafted Literal Run.

Recommendations For versions prior to r119, update to version r119 or later to resolve the issue. As a temporary workaround, consider restricting the use of the LZ4 compression algorithm on 32-bit platforms until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2024-06975

CVE-2014-4715

Affected Products

Lz4

Suse

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4715 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-4715 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4715 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-4715 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4715 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-4715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4715 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06975 · Security Note
• https://code.google.com/p/lz4/issues/detail?id=134 · Note
• https://t.me/cvenotify/21203 · Telegram Post
• https://t.me/cvenotify/21385 · Telegram Post
• http://blog.securitymouse.com/2014/07/i-was-wrong-proving-lz4-exploitable.html · Note
• https://t.me/cvenotify/21551 · Telegram Post
• https://code.google.com/p/lz4/source/detail?r=119 · Note