A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-zstd | Aug 22, 2024 | Jul 25, 2019 | |
| Debian | debian-upgrade-libzstd | Jul 30, 2024 | Jul 25, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-libzstdhuawei-euleros-2_0_sp8-upgrade-libzstd-develhuawei-euleros-2_0_sp8-upgrade-zstd | Jun 22, 2022 | Jul 25, 2019 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-zstd | Jul 11, 2022 | Jul 25, 2019 | |
| Suse | — | suse-upgrade-libzstd-develsuse-upgrade-libzstd-devel-staticsuse-upgrade-libzstd1suse-upgrade-libzstd1-32bitsuse-upgrade-libzstd1-64bitsuse-upgrade-zstd | Aug 13, 2019 | Jul 25, 2019 |
| Ubuntu | ubuntu-pro-upgrade-libzstd1ubuntu-pro-upgrade-zstdubuntu-upgrade-libzstd1ubuntu-upgrade-zstd | Aug 22, 2019 | Jul 25, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub