Ubuntu 21.04 USN-4968-1 Critical: LZ4 Denial Of Service Issue

ubuntu

May 26, 2021

LZ4 could be made to crash or run programs if it opened a specially crafted file.

Summary

LZ4 could be made to crash or run programs if it opened a specially crafted

file.

Software Description:

- lz4: Extremely fast compression algorithm

Details:

It was discovered that LZ4 incorrectly handled certain memory operations.

If a user or automated system were tricked into uncompressing a specially-crafted LZ4 file, a remote attacker could use this issue to cause LZ4 to

crash, resulting in a denial of service, or possibly execute arbitrary

code.

Topics Covered

security advisory denial of service security issue critical code execution Ubuntu ubuntu update recommendation lz4 LZ4

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.04:
  liblz4-1                        1.9.3-1ubuntu0.1

Ubuntu 20.10:
  liblz4-1                        1.9.2-2ubuntu0.20.10.1

Ubuntu 20.04 LTS:
  liblz4-1                        1.9.2-2ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  liblz4-1                        0.0~r131-2ubuntu3.1

In general, a standard system update will make all the necessary changes.