Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argume...

CVE-2021-3520 · published 5 years ago
Summary

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability,...

What to do
  • Update debian lz4 to version 1.9.3-2.
  • Update lz4_project lz4 to version 1.9.4 or later.
Affected software
Ecosystem VendorProductAffected versions
– lz4_project lz4 >= 1.8.3, < 1.9.4
cpe:2.3:a:lz4_project:lz4:*:*:*:*:*:*:*:*
– netapp active_iq_unified_manager All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
– netapp cloud_backup All versions
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
– netapp ontap_select_deploy_administration_utility All versions
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
– oracle communications_cloud_native_core_policy 1.14.0
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
– oracle zfs_storage_appliance_kit 8.8
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
– splunk universal_forwarder >= 8.2.0, < 8.2.12
>= 9.0.0, < 9.0.6
9.1.0
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
– – lz4 lz4-1.8.3
Debian:12 debian lz4 < 1.9.3-2
Fix: upgrade to 1.9.3-2
Original advisory text
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argume...
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-190Integer Overflow
CWE-787Out-of-bounds Write
Timeline
Published2 Jun 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-3520 · NVD
CVE-2021-3520 · MITRE
DEBIAN-CVE-2021-3520 · OSV
Track software like this
Free during beta