CVE-2021-27347
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to...
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
CVE-2021-27347- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
CVE-2021-27347- Updated
- 2026-11-02
EUVDEUVD-2021-14107 No score
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
EUVD-2021-14107- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-664h-5fq8-8969
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to...
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
GHSA-664h-5fq8-8969- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-27347
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
ALPINE-CVE-2021-27347- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
CVE-2021-27347- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-27347
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
DEBIAN-CVE-2021-27347- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-27347
Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted compressed file.
- Record
UBUNTU-CVE-2021-27347- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-5840-1 No score
lrzip vulnerabilities
It was discovered that Long Range ZIP incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted ZIP file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-25467)
It was discovered that Long Range ZIP incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted ZIP file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-27345, CVE-2021-27347)
It was discovered that Long Range ZIP incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted ZIP file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2022-26291)
It was discovered that Long Range ZIP incorrectly handled memory allocation, which could lead to a heap memory corruption. An attacker could possibly use this issue to cause denial of service. This issue affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-28044)
- Record
USN-5840-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lrzipAlpine:v3.17 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.18 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.19 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.20 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.21 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.22 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.23 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.24 |
before 0.640-r0 | 0.640-r0 |
lrzipDebian:12 |
before 0.640-1 | 0.640-1 |
lrzipDebian:13 |
before 0.640-1 | 0.640-1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lrzipDebian:14 |
before 0.640-1 | 0.640-1 |
lrzipDebian:9 From an advisory covering 5 CVEs |
before 0.631-1+deb9u2, plus listed versions 0.631-10.631-1+deb9u1 |
0.631-1+deb9u2 |
lrzipUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.608-20.616-10.616-1ubuntu0.1~esm0.616-1ubuntu0.1~esm10.616-1ubuntu0.1~esm2 |
None known |
lrzipUbuntu:18.04:LTS |
before 0.631-1+deb9u3build0.18.04.1, plus listed versions 0.631-10.631-1+deb9u1build0.18.04.1 |
0.631-1+deb9u3build0.18.04.1 |
lrzipUbuntu:20.04:LTS |
before 0.631+git180528-1+deb10u1build0.20.04.1, plus listed versions 0.631+git180528-10.631+git180528-1build1 |
0.631+git180528-1+deb10u1build0.20.04.1 |
lrzipUbuntu:Pro:14.04:LTS From an advisory covering 6 CVEs |
before 0.616-1ubuntu0.1~esm2, plus listed versions 0.608-20.616-10.616-1ubuntu0.1~esm0.616-1ubuntu0.1~esm1 |
0.616-1ubuntu0.1~esm2 |
lrzipUbuntu:Pro:16.04:LTS From an advisory covering 6 CVEs |
before 0.621-1ubuntu0.1~esm2, plus listed versions 0.621-10.621-1ubuntu0.1~esm1 |
0.621-1ubuntu0.1~esm2 |
lrzipUbuntu:18.04:LTS From an advisory covering 6 CVEs |
before 0.631-1+deb9u3build0.18.04.1, plus listed versions 0.631-10.631-1+deb9u1build0.18.04.1 |
0.631-1+deb9u3build0.18.04.1 |
lrzipUbuntu:20.04:LTS From an advisory covering 6 CVEs |
before 0.631+git180528-1+deb10u1build0.20.04.1, plus listed versions 0.631+git180528-10.631+git180528-1build1 |
0.631+git180528-1+deb10u1build0.20.04.1 |
lrzipUbuntu:22.04:LTS From an advisory covering 6 CVEs |
before 0.651-2ubuntu0.22.04.1, plus listed versions 0.641-10.651-2 |
0.651-2ubuntu0.22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-27347 is a medium vulnerability (CVSS 5.5) in Debian Linux, published June 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in lrzip 0.640-r0.