CVE-2019-17543
LowSummary
LZ4 before version 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with large input. This issue can also lead to data corruption.
Risk Assessment
The risk includes potential data corruption and possible remote code execution when processing malicious input through the vulnerable application.
Recommendation
Immediately update the LZ4 library to version 1.9.2 or later. If an update is not possible, limit the size of input data passed to the LZ4_compress_fast function.
Original NVD description (English source)
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at