CVE-2014-4611

Description

Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.

Risk Information

Base Score

8.8

MODERATE

Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

10.105

Associated Vulnerability

Vulnerability	OS Platform
Linux hardware enablement kernel from Saucy (USN-2287-1) linux-image-3.11.0-26-generic_3.11.0-26.45~precise1_i386.deb	Linux
Linux hardware enablement kernel from Saucy (USN-2287-1) linux-image-3.11.0-26-generic_3.11.0-26.45~precise1_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234