Skip to content
OpenAdvisories
Unscored USN-5171-2 10 CVEs

lrzip vulnerabilities

Published Dec 9, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

USN-5171-1 fixed vulnerabilities in Long Range ZIP.
This update provides the corresponding updates for Ubuntu 14.04 ESM and
Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Long Range ZIP incorrectly handled certain
specially crafted lrz files. A remote attacker could possibly use this
issue to cause a denial of service (crash) or other unspecified impact.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS lrzip 0.616-1ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS lrzip 0.621-1ubuntu0.1~esm1

Vulnerabilities 10

  • Unscored —
    CVE-2017-8844

    The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (he…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2017-8846

    The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2017-9928

    In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers t…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2017-9929

    In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attackers …

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-10685

    In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which a…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-11496

    In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in l…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-5650

    In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runz…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-5747

    In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-5786

    In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip…

    lrzip lrzip Debian Ubuntu
  • Unscored —
    CVE-2018-9058

    In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers …

    lrzip lrzip Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-8844
  • report
    https://ubuntu.com/security/CVE-2017-8846
  • report
    https://ubuntu.com/security/CVE-2017-9928
  • report
    https://ubuntu.com/security/CVE-2017-9929
  • report
    https://ubuntu.com/security/CVE-2018-5650
  • report
    https://ubuntu.com/security/CVE-2018-5747
  • report
    https://ubuntu.com/security/CVE-2018-5786
  • report
    https://ubuntu.com/security/CVE-2018-9058
  • report
    https://ubuntu.com/security/CVE-2018-10685
  • report
    https://ubuntu.com/security/CVE-2018-11496