Описание
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | pending | 1.2.0-4ubuntu0.1 |
| esm-infra-legacy/xenial | released | 1.0.3-1ubuntu1~16.04.2+esm1 |
| esm-infra/bionic | released | 1.0.3-1ubuntu1.3+esm1 |
| esm-infra/focal | released | 1.0.7-6ubuntu0.1+esm1 |
| jammy | released | 1.0.9-2ubuntu0.1 |
| noble | released | 1.1.0-2ubuntu0.1 |
| resolute | released | 1.2.0-3ubuntu0.1 |
| stonking | released | 1.2.0-4ubuntu0.1 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | needed | |
| focal | DNE | |
| jammy | DNE | |
| noble | released | 10.0.114-10.0.14-0ubuntu1~24.04.1 |
| resolute | released | 10.0.114-10.0.14-0ubuntu1~26.04.1 |
| stonking | released | 10.0.114-10.0.14-0ubuntu1~26.10.1 |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | needed | |
| focal | DNE | |
| jammy | DNE | |
| noble | DNE | |
| resolute | DNE | |
| stonking | released | 11.0.100-11.0.0~rc3-0ubuntu1~26.10.1 |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| focal | DNE | |
| jammy | deferred | |
| noble | DNE | |
| resolute | DNE | |
| stonking | DNE | |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| focal | DNE | |
| jammy | ignored | see notes |
| noble | DNE | |
| resolute | DNE | |
| stonking | DNE | |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| focal | DNE | |
| jammy | released | 8.0.133-8.0.33-0ubuntu1~22.04.1 |
| noble | released | 8.0.133-8.0.33-0ubuntu1~24.04.1 |
| resolute | DNE | |
| stonking | DNE | |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | uses system brotli |
| esm-apps-legacy/xenial | not-affected | code not present |
| esm-apps/bionic | not-affected | code not present |
| esm-apps/focal | needed | |
| esm-apps/jammy | not-affected | uses system brotli |
| esm-apps/noble | not-affected | uses system brotli |
| esm-apps/resolute | not-affected | uses system brotli |
| esm-infra-legacy/trusty | not-affected | code not present |
| jammy | not-affected | uses system brotli |
| noble | not-affected | uses system brotli |
Показывать по
Ссылки на источники
9.8 Critical
CVSS3
Связанные уязвимости
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) ...
9.8 Critical
CVSS3