CVE-2017-8844

High

Published: 08/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The read_1g function in stream.c in liblrzip.so in lrzip version 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.

Risk Assessment

Attackers can exploit this vulnerability to remotely trigger application crashes, potentially leading to service availability interruptions.

Recommendation

It is recommended to update to the latest version of lrzip to mitigate this vulnerability and to monitor systems for unauthorized access attempts.

Other vulnerabilities in lrzip 0.631

CVE-2023-39741Medium
In lrzip version 0.651, a heap overflow was discovered in the libzpaq::PostProcessor::write(int) function in /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.

Original NVD description (English source)

The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.