CVE & CISA-KEV Catalog

CVE-2021-3520

CRITICALEPSS 87th pctl
9.8
CVSS v3
NVD

Description

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

How to fix

Remediation Available
lz4Debian
Fixed in:1.9.3-2CVE-2021-3520
Fixed in:1.9.3-2CVE-2021-3520
Fixed in:1.9.3-2CVE-2021-3520
Fixed in:1.9.3-2CVE-2021-3520
liblz4-1Ubuntu
Fixed in:0.0~r114-2ubuntu1+esm2USN-4968-2
Fixed in:0.0~r131-2ubuntu2+esm1USN-4968-2
Fixed in:0.0~r131-2ubuntu3.1USN-4968-1
Fixed in:1.9.2-2ubuntu0.20.04.1USN-4968-1
lz4Ubuntu
Fixed in:0.0~r114-2ubuntu1+esm2USN-4968-2
Fixed in:0.0~r131-2ubuntu2+esm1USN-4968-2
Fixed in:0.0~r131-2ubuntu3.1USN-4968-1
Fixed in:1.9.2-2ubuntu0.20.04.1USN-4968-1
UniversalForwarderWindows application
Affected:8.2.0 8.2.12Fixed in:8.2.12Splunk, Inc.
Affected:9.0.0 9.0.6Fixed in:9.0.6Splunk, Inc.

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

3.22%probability of exploitation in 30 days
87thpercentile

Elevated risk: more likely to be exploited than 87% of all known CVEs.

References

Related Vulnerabilities

Other CWE-190 (Integer Overflow) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2020-16040Medium6.5100%-Fix
CVE-2019-11477High7.599%-Fix
CVE-2023-44443High7.894%-Fix
CVE-2014-0569High9.390%--
CVE-2017-3599High7.590%-Fix
CVE-2023-21716Critical9.882%-Fix
Embed a live status badge for CVE-2021-3520
CVE-2021-3520 severity badge

Markdown

[![CVE-2021-3520](https://tridentstack.com/cve/badge/CVE-2021-3520.svg)](https://tridentstack.com/cve/CVE-2021-3520)

HTML

<a href="https://tridentstack.com/cve/CVE-2021-3520"><img src="https://tridentstack.com/cve/badge/CVE-2021-3520.svg" alt="CVE-2021-3520"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.