{"schema_version":"1.7.2","id":"OESA-2021-1245","modified":"2021-06-26T11:03:00Z","published":"2021-06-26T11:03:00Z","upstream":["CVE-2021-3520"],"summary":"lz4 security update","details":"LZ4 is lossless compression algorithm, providing compression speed \u003e 500 MB/s per core (\u003e0.15 Bytes/cycle). It features an extremely fast decoder, with speed in multiple GB/s per core (~1 Byte/cycle). A high compression derivative, called LZ4_HC, is available, trading customizable CPU time for compression ratio.\r\n\r\nSecurity Fix(es):\r\n\r\nThere s a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.(CVE-2021-3520)","affected":[{"package":{"ecosystem":"openEuler:20.03-LTS-SP1","name":"lz4","purl":"pkg:rpm/openEuler/lz4\u0026distro=openEuler-20.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-3.oe1"}]}],"ecosystem_specific":{"aarch64":["lz4-devel-1.9.2-3.oe1.aarch64.rpm","lz4-debuginfo-1.9.2-3.oe1.aarch64.rpm","lz4-debugsource-1.9.2-3.oe1.aarch64.rpm","lz4-1.9.2-3.oe1.aarch64.rpm"],"noarch":["lz4-help-1.9.2-3.oe1.noarch.rpm"],"src":["lz4-1.9.2-3.oe1.src.rpm"],"x86_64":["lz4-debugsource-1.9.2-3.oe1.x86_64.rpm","lz4-1.9.2-3.oe1.x86_64.rpm","lz4-devel-1.9.2-3.oe1.x86_64.rpm","lz4-debuginfo-1.9.2-3.oe1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1245"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3520"}],"database_specific":{"severity":"Critical"}}