CVE-2019-17543 Memory corruption in n/a
Heap-based buffer overflow in LZ4 library allows attackers to execute arbitrary code or cause denial of service via large inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17543?
CVE-2019-17543 is a high-severity memory corruption vulnerability in n/a, published on 14 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
Weakness: CWE-787
Which versions are affected by CVE-2019-17543?
It affects 1 product.
Linux distribution packages (17)
lz4 AlmaLinux:8 | All versions | 1.8.3-5.el8_10 |
lz4-devel AlmaLinux:8 | All versions | 1.8.3-5.el8_10 |
lz4-libs AlmaLinux:8 | All versions | 1.8.3-5.el8_10 |
lz4 Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.3-5.el8_10 |
lz4-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.3-5.el8_10 |
lz4-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.3-5.el8_10 |
lz4-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.3-5.el8_10 |
lz4-libs Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.3-5.el8_10 |
lz4-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.3-5.el8_10 |
lz4 Rocky Linux:8 | All versions | 0:1.8.3-5.el8_10 |
lz4 SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 1.8.0-3.5.1 |
lz4 SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 1.8.0-3.5.1 |
lz4 openSUSE:Leap 15.0 | All versions | 1.8.0-lp150.2.3.1 |
lz4-test openSUSE:Leap 15.0 | All versions | 1.8.0-lp150.2.3.1 |
lz4 openSUSE:Leap 15.1 | All versions | 1.8.0-lp151.3.3.1 |
lz4-test openSUSE:Leap 15.1 | All versions | 1.8.0-lp151.3.3.1 |
lz4 openSUSE:Tumbleweed | All versions | 1.9.3-1.5 |
Products include Lz4 Project Lz4.
How do I fix CVE-2019-17543?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-17543 being exploited?
There is no known exploitation of CVE-2019-17543 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2019-17543, ALSA-2025:11035, DEBIAN-CVE-2019-17543, GHSA-fxrv-74g3-w7qr, MGASA-2019-0375, RHSA-2025:11035 and 5 more.