CVE-2019-17543: Buffer Overflow
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-17543?
CVE-2019-17543 is a vulnerability in LZ4 before version 1.9.2 that allows for a heap-based buffer overflow in LZ4_write32, leading to potential data corruption. It affects applications that call LZ4_compress_fast with a large input.
What is the severity of CVE-2019-17543?
The severity of CVE-2019-17543 is high, with a CVSS score of 8.1.
Which software is affected by CVE-2019-17543?
IBM Security Verify Access versions up to but excluding 1.9.2 are affected by CVE-2019-17543.
How can I fix CVE-2019-17543?
To fix CVE-2019-17543, upgrade LZ4 to version 1.9.2 or later.
Are there any references related to CVE-2019-17543?
Yes, you can find more information about CVE-2019-17543 at the following references: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html), [Link 3](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941).