{"id":"CVE-2019-17543","aliases":["ALPINE-CVE-2019-17543","ALSA-2025:11035","BELL-CVE-2019-17543","DEBIAN-CVE-2019-17543","EUVD-2019-7893","GHSA-fxrv-74g3-w7qr","MGASA-2019-0375","RHSA-2025:11035","RLSA-2025:11035","SUSE-SU-2019:2757-1","SUSE-SU-2021:1613-1","UBUNTU-CVE-2019-17543","openSUSE-SU-2019:2398-1","openSUSE-SU-2019:2399-1","openSUSE-SU-2024:11034-1"],"status":"published","title":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to...","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.10451,"percentile":0.95776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-787"],"published":"2019-10-14T01:09:00Z","modified":"2026-10-29T11:02:26Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"lz4","fixed_in":["1.9.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"lz4","fixed_in":["1.9.2-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lz4","fixed_in":["1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lz4-devel","fixed_in":["1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lz4-libs","fixed_in":["1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lz4","fixed_in":["1.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lz4","fixed_in":["1.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lz4","fixed_in":["1.9.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"lz4","fixed_in":["1.9.2-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4","fixed_in":["0:1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-debuginfo","fixed_in":["0:1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-debugsource","fixed_in":["0:1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-devel","fixed_in":["0:1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-libs","fixed_in":["0:1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-libs-debuginfo","fixed_in":["0:1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"lz4","fixed_in":["0:1.8.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"lz4","fixed_in":["1.8.0-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"lz4","fixed_in":["1.8.0-3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"lz4","fixed_in":["1.8.0-lp150.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"lz4-test","fixed_in":["1.8.0-lp150.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"lz4","fixed_in":["1.8.0-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"lz4-test","fixed_in":["1.8.0-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lz4","fixed_in":["1.9.3-1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lz4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lz4-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lz4-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"lz4-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"lz4-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lz4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-1.5"}]}]}],"products":[{"vendor":"lz4_project","product":"lz4"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3%40%3Cissues.arrow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3%40%3Cdev.arrow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357%40%3Cissues.arrow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316%40%3Cissues.arrow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17%40%3Cissues.arrow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6%40%3Cissues.arrow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960%40%3Cissues.kudu.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720%40%3Cissues.kudu.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/lz4/lz4/pull/756","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/lz4/lz4/pull/760","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/lz4/lz4/issues/801","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26%40%3Cissues.kudu.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210723-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17543","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17@%3Cissues.arrow.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6@%3Cissues.arrow.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357@%3Cissues.arrow.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3@%3Cissues.arrow.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316@%3Cissues.arrow.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3@%3Cdev.arrow.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26@%3Cissues.kudu.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720@%3Cissues.kudu.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960@%3Cissues.kudu.apache.org%3E"},{"url":"https://security.netapp.com/advisory/ntap-20210723-0001"},{"url":"https://github.com/advisories/GHSA-fxrv-74g3-w7qr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-17543","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11035","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17543","tags":["report"]},{"url":"https://bugzilla.redhat.com/1765316","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-11035.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-17543","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17543","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0375.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25805","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-10/msg00171.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765316","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11035.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17543","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:11035","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192757-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1153936","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17543","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211613-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185438","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3520","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17543","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K7YFHI6XFRGBVSXNEVWR4PPHMCTX5SO6/#K7YFHI6XFRGBVSXNEVWR4PPHMCTX5SO6","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WYYDWMO34OK7XA7H4QNW6VMAS3LHI33N/#WYYDWMO34OK7XA7H4QNW6VMAS3LHI33N","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","status":"published","published":"2019-10-14T01:09:00Z","modified":"2026-10-14T06:54:46.324Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7893","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","status":"published","published":"2019-10-14T01:09:00Z","modified":"2026-10-14T06:54:46Z","updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-fxrv-74g3-w7qr","title":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to...","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.)","status":"published","published":"2022-05-24T16:58:45Z","modified":"2026-10-14T09:32:28Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","status":"published","published":"2019-10-14T02:15:10.873Z","modified":"2026-10-14T07:16:49.003Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"ALPINE-CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","status":"published","published":"2019-10-14T02:15:10.873Z","modified":"2026-09-21T06:17:52.499982689Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-17543","title":"CVE-2019-17543 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:57.229333Z","modified":"2026-03-05T07:15:19.363213Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","status":"published","published":"2019-10-14T02:15:10.873Z","modified":"2026-10-20T13:45:09.712534456Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","status":"published","published":"2019-10-14T02:15:10.873Z","modified":"2026-10-15T07:47:35.642188461Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2025:11035","title":"Red Hat Security Advisory: lz4 security update","status":"published","published":"2025-07-15T10:08:07Z","modified":"2026-03-18T11:38:16.494939Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RLSA-2025:11035","title":"Moderate: lz4 security update","description":"The lz4 packages provide support for LZ4, a very fast, lossless compression algorithm that provides compression speeds of 400 MB/s per core and scales with multicore CPUs. It also features an extremely fast decoder that reaches speeds of multiple GB/s per core and typically reaches RAM speed limits on multicore systems.\n\nSecurity Fix(es):\n\n* lz4: heap-based buffer overflow in LZ4_write32 (CVE-2019-17543)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:26.98262Z","modified":"2025-07-29T14:59:57.38943Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"","status":"withdrawn","published":"2019-10-14T02:15:00Z","modified":"2025-07-16T08:14:31.565084Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALSA-2025:11035","title":"Moderate: lz4 security update","description":"The lz4 packages provide support for LZ4, a very fast, lossless compression algorithm that provides compression speeds of 400 MB/s per core and scales with multicore CPUs. It also features an extremely fast decoder that reaches speeds of multiple GB/s per core and typically reaches RAM speed limits on multicore systems.  \n\nSecurity Fix(es):  \n\n  * lz4: heap-based buffer overflow in LZ4_write32 (CVE-2019-17543)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-15T00:00:00Z","modified":"2026-10-29T11:02:26.314549324Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"MGASA-2019-0375","title":"Updated lz4 packages fix security vulnerability","description":"Updated lz4 packages fix security vulnerability:\n\nHeap-based buffer overflow in LZ4_write32 (CVE-2019-17543).\n","status":"published","published":"2019-12-08T18:12:18Z","modified":"2026-04-16T04:44:38.997636167Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2398-1","title":"Security update for lz4","description":"This update for lz4 fixes the following issues:\n\n- CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-28T19:27:56Z","modified":"2026-02-04T03:16:03.612991Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2399-1","title":"Security update for lz4","description":"This update for lz4 fixes the following issues:\n\n- CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-28T19:28:07Z","modified":"2025-05-07T18:10:52.60131Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11034-1","title":"liblz4-1-1.9.3-1.5 on GA media","description":"These are all security issues fixed in the liblz4-1-1.9.3-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:10:52.664438Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:2757-1","title":"Security update for lz4","description":"This update for lz4 fixes the following issues:\n\n- CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936).\n","status":"published","published":"2019-10-23T15:21:22Z","modified":"2026-02-04T04:28:37.291449Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2021:1613-1","title":"Security update for lz4","description":"This update for lz4 fixes the following issues:\n\n- CVE-2021-3520: Fixed memory corruption due to an integer overflow bug caused by memmove argument (bsc#1185438).\n- CVE-2019-17543: Fixed heap-based buffer overflow in LZ4_write32 (bsc#1153936).\n","status":"published","published":"2021-05-14T15:35:25Z","modified":"2026-02-04T03:18:25.789263Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}