Acknowledged
Created: Apr 8, 2019
Updated: Nov 13, 2019
Found In Version: 10.19.45.1
Severity: Standard
Applicable for: Wind River Linux LTS 19
Component/s: Userspace
The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive, a different vulnerability than CVE-2017-8845.
https://nvd.nist.gov/vuln/detail/CVE-2019-10654
There is no fix, here is the reply from upstream lzo [1]
...
Hello N3vv,
based on the output I get, I think it is the same issue. However it is still not fixed, so basically this is an incomplete fix for CVE-2017-8845
...
[1] https://github.com/ckolivas/lrzip/issues/108