CVE-2019-17543High· 8.1▾ TwilightLZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 2.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
9.1%
Last analysed / modified upstream
9.1% → 10%
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
lz4 < 1.9.2Upgrade past the affected range:
lz4 1.9.2Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3520Critical· 9.8There's a flaw in lz4
CVE-2020-15358Medium· 5.5In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CVE-2020-8285High· 7.5curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-10543High· 8.2Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
CVE-2020-10531High· 8.8An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1
CVE-2019-5482Critical· 9.8Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.