There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1954559 | Issue Tracking Patch Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20211104-0005/ | Third Party Advisory |
| https://www.oracle.com//security-alerts/cpujul2021.html | Patch Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Patch Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
06 Jun 2024, 20:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netapp cloud Backup
|
|
| CPE | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* cpe:2.3:a:lz4_project:lz4:*:*:*:*:*:*:*:* |
27 Mar 2024, 16:12
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Splunk
Splunk universal Forwarder |
|
| CPE | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |
07 Nov 2023, 03:38
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
Information
Published : 2021-06-02 13:15
Updated : 2024-06-06 20:25
NVD link : CVE-2021-3520
Mitre link : CVE-2021-3520
CVE.ORG link : CVE-2021-3520
JSON object : View
Products Affected
lz4_project
- lz4
netapp
- cloud_backup
- ontap_select_deploy_administration_utility
- active_iq_unified_manager
oracle
- zfs_storage_appliance_kit
- communications_cloud_native_core_policy
splunk
- universal_forwarder