Wind River Support Network

HomeDefectsLIN1019-1034
Acknowledged

LIN1019-1034 : Security Advisory - lzo - CVE-2019-10654

Created: Apr 8, 2019    Updated: Nov 13, 2019
Found In Version: 10.19.45.1
Severity: Standard
Applicable for: Wind River Linux LTS 19
Component/s: Userspace

Description

The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive, a different vulnerability than CVE-2017-8845.

https://nvd.nist.gov/vuln/detail/CVE-2019-10654

There is no fix, here is the reply from upstream lzo [1]
...
Hello N3vv,
based on the output I get, I think it is the same issue. However it is still not fixed, so basically this is an incomplete fix for CVE-2017-8845
...
[1] https://github.com/ckolivas/lrzip/issues/108

CVEs


Live chat
Online