CVE-2018-11498

Опубликовано: 26 мая 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file, as well as achieve remote code execution.

Ссылки

https://github.com/inikep/lizard/issues/16
Third Party Advisory
https://github.com/inikep/lizard/issues/16
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:lizard_project:lizard:1.0:*:*:*:*:*:*:*

cpe:2.3:a:lizard_project:lz5:2.0:*:*:*:*:*:*:*

EPSS

Процентиль: 85%

0.02511

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-119

Связанные уязвимости

GHSA-f6g3-24r8-3r58