SB2017050809 - Multiple vulnerabilities in lrzip

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017050809

SB2017050809 - Multiple vulnerabilities in lrzip

Published: May 8, 2017 Updated: May 25, 2022

Security Bulletin ID SB2017050809
Severity
Medium
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 85% Low 15%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2019-10654)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive, a different vulnerability than CVE-2017-8845.


2) Use-after-free (CVE-ID: CVE-2018-11496)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in lrzip.c lacks certain size validation.


3) Use-after-free (CVE-ID: CVE-2018-5747)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.


4) Buffer overflow (CVE-ID: CVE-2017-9928)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers to cause a denial of service via a crafted file.


5) Buffer overflow (CVE-ID: CVE-2017-9929)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attackers to cause a denial of service via a crafted file.


6) Division by zero (CVE-ID: CVE-2017-8842)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to divide-by-zero error within The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631. A remote attacker can perform a denial of service (divide-by-zero error and application crash) via a crafted archive.


7) NULL pointer dereference (CVE-ID: CVE-2017-8843)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted archive.


8) Heap-based buffer overflow (CVE-ID: CVE-2017-8844)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in The read_1g function in stream.c in liblrzip.so in lrzip 0.631. A remote attacker can use a crafted archive. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


9) Out-of-bounds read (CVE-ID: CVE-2017-8845)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive.


10) Use-after-free (CVE-ID: CVE-2017-8846)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted archive. A remote attackers can cause a denial of service (use-after-free and application crash).

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


11) NULL pointer dereference (CVE-ID: CVE-2017-8847)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted archive.


12) NULL pointer dereference (CVE-ID: CVE-2021-27345)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the ucompthread in stream.c. A remote attacker can trick the victim to open a specially crafted compressed file and trigger denial of service conditions.


13) Use-after-free (CVE-ID: CVE-2021-27347)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in lzma_decompress_buf function in stream.c. A remote attacker can trick the victim to open a specially crafted compressed file and trigger denial of service conditions.


Remediation

Install update from vendor's website.

References