Debian/lz4: critical 9.8
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument,
Action: Upgrade lz4 to 1.9.3-2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.9.3-2 | - |
Fixed versions
| 1.9.3-2 |
Sources
published · modified · JSON