Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 16.04 ESM: USN-4968-2 Critical LZ4 Denial of Service

ubuntu
Calendar Grey May 31, 2021
Dist Ubuntu Esm H88
An issue with LZ4 in certain Ubuntu versions poses a risk of system crashes or potential unauthorized code execution. Prompt patching is essential.
LZ4 could be made to crash or run programs if it opened a specially crafted file.

Summary

LZ4 could be made to crash or run programs if it opened a specially crafted

file.

Software Description:

- lz4: Extremely fast compression algorithm

Details:

USN-4968-1 fixed a vulnerability in LZ4. This update provides

the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that LZ4 incorrectly handled certain memory operations.

If a user or automated system were tricked into uncompressing a specially-

crafted LZ4 file, a remote attacker could use this issue to cause LZ4 to

crash, resulting in a denial of service, or possibly execute arbitrary

code.

Topics%20covered

Topics Covered

security advisory denial of service critical threat ubuntu lz4

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  liblz4-1                        0.0~r131-2ubuntu2+esm1

Ubuntu 14.04 ESM:
  liblz4-1                        0.0~r114-2ubuntu1+esm2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4968-2

https://ubuntu.com/security/notices/USN-4968-1

CVE-2021-3520

Severity
critical
Lowest
Low
Medium
High
Critical

May 31, 2021

Topics%20covered

Topics Covered

security advisory denial of service critical threat ubuntu lz4

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here