Skip to content
OpenAdvisories
Unscored USN-5171-1 10 CVEs

lrzip vulnerabilities

Published Dec 6, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Long Range ZIP incorrectly handled certain
specially crafted lrz files. A remote attacker could possibly use this
issue to cause a denial of service (crash) or other unspecified impact.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS lrzip 0.631-1+deb9u1build0.18.04.1

Vulnerabilities 10

  • Unscored —
    CVE-2017-8844

    The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (he…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2017-8846

    The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2017-9928

    In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers t…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2017-9929

    In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attackers …

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-10685

    In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which a…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-11496

    In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in l…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-5650

    In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runz…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-5747

    In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-5786

    In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-9058

    In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers …

    lrzip lrzip Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-8844
  • report
    https://ubuntu.com/security/CVE-2017-8846
  • report
    https://ubuntu.com/security/CVE-2017-9928
  • report
    https://ubuntu.com/security/CVE-2017-9929
  • report
    https://ubuntu.com/security/CVE-2018-5650
  • report
    https://ubuntu.com/security/CVE-2018-5747
  • report
    https://ubuntu.com/security/CVE-2018-5786
  • report
    https://ubuntu.com/security/CVE-2018-9058
  • report
    https://ubuntu.com/security/CVE-2018-10685
  • report
    https://ubuntu.com/security/CVE-2018-11496