2019-10-14 02:00:58 +00:00
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org" ,
"ID" : "CVE-2019-17543" ,
"STATE" : "PUBLIC"
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a" ,
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
} ,
"vendor_name" : "n/a"
}
]
}
} ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2019-10-17 11:01:03 +00:00
"value" : "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\""
2019-10-14 02:00:58 +00:00
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "n/a"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"url" : "https://github.com/lz4/lz4/pull/756" ,
"refsource" : "MISC" ,
"name" : "https://github.com/lz4/lz4/pull/756"
} ,
{
"url" : "https://github.com/lz4/lz4/pull/760" ,
"refsource" : "MISC" ,
"name" : "https://github.com/lz4/lz4/pull/760"
} ,
{
"url" : "https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2" ,
"refsource" : "MISC" ,
"name" : "https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2"
} ,
{
"url" : "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941" ,
"refsource" : "MISC" ,
"name" : "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941"
2019-10-17 11:01:03 +00:00
} ,
{
"refsource" : "MISC" ,
"name" : "https://github.com/lz4/lz4/issues/801" ,
"url" : "https://github.com/lz4/lz4/issues/801"
2019-10-24 15:01:04 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[arrow-issues] 20191024 [jira] [Created] (ARROW-6984) Update LZ4 to 1.9.2 for CVE-2019-17543" ,
"url" : "https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3@%3Cissues.arrow.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[arrow-dev] 20191024 [jira] [Created] (ARROW-6984) Update LZ4 to 1.9.2 for CVE-2019-17543" ,
"url" : "https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3@%3Cdev.arrow.apache.org%3E"
2019-10-24 17:01:05 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[arrow-issues] 20191024 [jira] [Updated] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543" ,
"url" : "https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357@%3Cissues.arrow.apache.org%3E"
2019-10-24 18:01:07 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[arrow-issues] 20191024 [jira] [Assigned] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543" ,
"url" : "https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316@%3Cissues.arrow.apache.org%3E"
2019-10-25 11:01:13 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[arrow-issues] 20191025 [jira] [Commented] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543" ,
"url" : "https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17@%3Cissues.arrow.apache.org%3E"
2019-10-29 19:01:09 +00:00
} ,
{
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2399" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html"
} ,
{
"refsource" : "SUSE" ,
"name" : "openSUSE-SU-2019:2398" ,
"url" : "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html"
2019-11-06 16:01:28 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[arrow-issues] 20191106 [jira] [Resolved] (ARROW-6984) [C++] Update LZ4 to 1.9.2 for CVE-2019-17543" ,
"url" : "https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6@%3Cissues.arrow.apache.org%3E"
2020-06-22 08:01:27 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[kudu-issues] 20200621 [jira] [Updated] (KUDU-3156) Whether the CVE-2019-17543 vulnerability of lz affects kudu" ,
"url" : "https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960@%3Cissues.kudu.apache.org%3E"
} ,
{
"refsource" : "MISC" ,
"name" : "https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26@%3Cissues.kudu.apache.org%3E" ,
"url" : "https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26@%3Cissues.kudu.apache.org%3E"
2020-07-09 20:01:38 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[kudu-issues] 20200709 [jira] [Resolved] (KUDU-3156) Whether the CVE-2019-17543 vulnerability of lz affects kudu" ,
"url" : "https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720@%3Cissues.kudu.apache.org%3E"
2020-10-20 12:39:21 -07:00
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpuoct2020.html"
2019-10-14 02:00:58 +00:00
}
]
}
}
