CVE-2017-8844

HIGH

long_range_zip 0.631 - Heap-Based Buffer Overflow in read_1g Function

Title source: llm
STIX 2.1

Description

The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.

References (4)

Core 4
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/ckolivas/lrzip/issues/70
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202005-01
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/08/msg00001.html

Scores

CVSS v3 7.8
EPSS 0.0160
EPSS Percentile 72.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (2)
debian/debian_linux 9.0
long_range_zip_project/long_range_zip 0.631
Published May 08, 2017
Tracked Since Feb 18, 2026