Описание
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
Ссылки
EPSS
7.7 High
CVSS3
Дефекты
Связанные уязвимости
(zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where ...)
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where ...
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
Уязвимость компонентов ZstdCompressCtx и ZstdDecompressCtx библиотеки сжатия данных zstd-jni, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.7 High
CVSS3