Описание
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| lrzip | fixed | 0.640-1 | package | |
| lrzip | fixed | 0.631+git180528-1+deb10u1 | buster | package |
Примечания
https://github.com/ckolivas/lrzip/issues/165
https://github.com/ckolivas/lrzip/commit/be884d09e09b00fbddd31b75dc1f4736d72006a8 (v0.640)
Crash in CLI tool, no security impact
See CVE-2022-26291 follow-up related to clear_rulist()
EPSS
Связанные уязвимости
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
Уязвимость функции lzma_decompress_buf компонента stream.c программы сжатия Lrzip, связанная с использованием памяти после её освобождения, позволяющая нарушителю вызвать отказ в обслуживании
EPSS