OESA-2021-1245

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1245
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2021-1245.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2021-1245
Upstream
Published
2021-06-26T11:03:00Z
Modified
2025-09-03T06:17:29.458499Z
Summary
lz4 security update
Details

LZ4 is lossless compression algorithm, providing compression speed > 500 MB/s per core (>0.15 Bytes/cycle). It features an extremely fast decoder, with speed in multiple GB/s per core (~1 Byte/cycle). A high compression derivative, called LZ4_HC, is available, trading customizable CPU time for compression ratio.

Security Fix(es):

There s a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.(CVE-2021-3520)

Database specific 
{
    "severity": "Critical"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / lz4

Package

Name
lz4
Purl
pkg:rpm/openEuler/lz4&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.9.2-3.oe1

Ecosystem specific 

{
    "x86_64": [
        "lz4-debugsource-1.9.2-3.oe1.x86_64.rpm",
        "lz4-1.9.2-3.oe1.x86_64.rpm",
        "lz4-devel-1.9.2-3.oe1.x86_64.rpm",
        "lz4-debuginfo-1.9.2-3.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "lz4-devel-1.9.2-3.oe1.aarch64.rpm",
        "lz4-debuginfo-1.9.2-3.oe1.aarch64.rpm",
        "lz4-debugsource-1.9.2-3.oe1.aarch64.rpm",
        "lz4-1.9.2-3.oe1.aarch64.rpm"
    ],
    "noarch": [
        "lz4-help-1.9.2-3.oe1.noarch.rpm"
    ],
    "src": [
        "lz4-1.9.2-3.oe1.src.rpm"
    ]
}