SB2022090234 - Ubuntu update for libzstd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022090234

SB2022090234 - Ubuntu update for libzstd

Published: September 2, 2022

Security Bulletin ID SB2022090234
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Race condition (CVE-ID: CVE-2019-11922)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows an attacker to execute arbitrary code on the target system.

The vulnerability exists due to a race condition in the one-pass compression functions. A remote attacker can exploit the race and write bytes out of bounds if an output buffer smaller than the recommended size was used.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the target system.


Remediation

Install update from vendor's website.

References