Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade lzo. | Aug 30, 2017 | Jul 1, 2014 |
| Centos_linux | — | Upgrade lzo-minilzoUpgrade lzo-develUpgrade lzo | Aug 17, 2018 | Jul 9, 2014 |
| Debian | — | Upgrade lzo2Upgrade busybox | Feb 20, 2019 | Jul 27, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 4, 2016 |
| Freebsd | — | Upgrade krfb | Dec 10, 2025 | Aug 3, 2014 |
| Gentoo Linux | — | Upgrade sys-apps/busybox.Upgrade dev-libs/lzo. | Oct 30, 2017 | Mar 29, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade dump | Jul 23, 2019 | Jun 26, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade dump | Sep 25, 2019 | Jun 26, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade dump | Nov 19, 2019 | Jun 26, 2014 |
| Oracle_linux | — | Upgrade lzoUpgrade lzo-minilzoUpgrade lzo-devel | Oct 16, 2024 | Feb 12, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 12, 2020 |
| Suse | — | Upgrade liblzo2-2-x86Upgrade lzo-develUpgrade icecreamUpgrade lzo-devel-staticUpgrade libvncserver0Upgrade libvncclient0Upgrade lzo-devel-32bitUpgrade liblzo2-2-32bitUpgrade liblzo2-2 | Dec 18, 2015 | Jul 16, 2014 |
| Ubuntu | — | Upgrade liblzo2-2 | Nov 8, 2024 | Feb 12, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub