Summary
It was discovered that Long Range ZIP incorrectly handled pointers. If
a user or an automated system were tricked into opening a certain
specially crafted ZIP file, an attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 14.04 ESM,
Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-25467)
It was discovered that Long Range ZIP incorrectly handled pointers. If
a user or an automated system were tricked into opening a certain
specially crafted ZIP file, an attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 18.04 LTS
and Ubuntu 20.04 LTS. (CVE-2021-27345, CVE-2021-27347)
It was discovered that Long Range ZIP incorrectly handled pointers. If
a user or an automated system were tricked into opening a certain
specially crafted ZIP file, an attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 16.04 ESM,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2022-26291)
It was discovered that Long Range ZIP incorrectly handled memory allocation,
which could lead to a heap memory corruption. An attacker could possibly use
this issue to cause denial of service. This issue affected Ubuntu 14.04 ESM,
Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and
Ubuntu 22.10. (CVE-2022-28044)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | lrzip | 0.631-1+deb9u3build0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | lrzip | 0.631+git180528-1+deb10u1build0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | lrzip | 0.651-2ubuntu0.22.04.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | lrzip | 0.616-1ubuntu0.1~esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | lrzip | 0.621-1ubuntu0.1~esm2 |
Vulnerabilities 6
-
Unscored —
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip…
-
Unscored —
A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cau…
-
Unscored —
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a d…
-
Unscored —
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (…
-
Unscored —
lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf(…
-
Unscored —
Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.