{"id":"CVE-2025-62813","aliases":["BELL-CVE-2025-62813","DEBIAN-CVE-2025-62813","EUVD-2025-35652","GHSA-r7j2-9m2h-fq95","MGASA-2026-0145","UBUNTU-CVE-2025-62813","openSUSE-SU-2025:15675-1","openSUSE-SU-2025:15678-1","openSUSE-SU-2025:15679-1","openSUSE-SU-2025:15688-1"],"status":"rejected","title":"LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-158"],"published":"2025-10-23T00:00:00Z","modified":"2026-05-16T18:00:05Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"coreboot-utils","fixed_in":["25.09-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","fixed_in":["115.15.0-6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","fixed_in":["128.14.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs140","fixed_in":["140.4.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:9","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.10.2-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:9","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.10.2-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.10.2-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.10.2-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"coreboot-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.09-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.15.0-6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs140","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.4.0-2.1"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62813"},{"url":"https://github.com/lz4/lz4/pull/1593","tags":["fix","report"]},{"url":"https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82","tags":["fix","report"]},{"url":"https://github.com/advisories/GHSA-r7j2-9m2h-fq95"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-62813","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-62813","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0145.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35508","tags":["report"]},{"url":"https://www.firefox.com/en-US/firefox/140.10.2/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/140.10.2esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-41/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-44/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-62813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62813","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62813","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-62813","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2025-10-23T00:00:00Z","modified":"2025-10-29T05:41:00.849Z","updated_at":"2026-11-02T14:32:54.87586Z"}],"euvd":[{"id":"EUVD-2025-35652","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2025-10-23T00:00:00Z","modified":"2025-10-29T05:41:00Z","updated_at":"2026-11-02T19:49:36.644055Z"}],"ghsa":[{"id":"GHSA-r7j2-9m2h-fq95","title":"LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly...","description":"LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.","status":"published","published":"2025-10-23T06:31:00Z","modified":"2025-10-23T06:31:00Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-158"],"updated_at":"2026-11-02T15:04:11.563124Z"}],"nvd":[{"id":"CVE-2025-62813","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2025-10-23T04:17:26.35Z","modified":"2026-11-09T20:10:00.2Z","updated_at":"2026-11-09T22:15:49.324772Z"}],"osv":[{"id":"BELL-CVE-2025-62813","title":"CVE-2025-62813 does not affect BellSoft software","status":"withdrawn","published":"2025-10-24T06:05:20.2827Z","modified":"2026-03-05T07:15:14.23772Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-62813","description":"LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.","status":"published","published":"2025-10-23T04:17:26Z","modified":"2026-04-12T18:47:03.869709Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"UBUNTU-CVE-2025-62813","description":"LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.","status":"withdrawn","published":"2025-10-24T00:00:00Z","modified":"2025-10-27T08:32:45.494712Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DEBIAN-CVE-2025-62813","description":"LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.","status":"withdrawn","published":"2025-10-23T04:17:26Z","modified":"2025-11-04T14:34:02.892719Z","updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"MGASA-2026-0145","title":"Updated firefox \u0026 thunderbird packages fix security vulnerabilities","description":"LZ4 compression library issue. (CVE-2025-62813)\nlibexpat before 2.7.5 allows a NULL pointer dereference with empty\nexternal parameter entity content. (CVE-2026-32776)\nlibexpat before 2.7.5 allows an infinite loop while parsing DTD content.\n(CVE-2026-32777)\nlibexpat before 2.7.5 allows a NULL pointer dereference in the function\nsetContext on retry after an earlier ouf-of-memory condition.\n(CVE-2026-32778)\nUse-after-free in the DOM: Networking component. (CVE-2026-8090)\nMemory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2,\nFirefox 150.0.2, Thunderbird ESR 140.10.2 and Thunderbird 150.0.2.\n(CVE-2026-8092)\nAnother issue in the WebRTC component. (CVE-2026-8094)\n","status":"published","published":"2026-05-16T17:45:40Z","modified":"2026-05-16T18:00:05.930851Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15675-1","title":"coreboot-utils-25.09-2.1 on GA media","description":"These are all security issues fixed in the coreboot-utils-25.09-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-29T00:00:00Z","modified":"2026-03-23T04:54:05.17537Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15678-1","title":"libmozjs-115-0-115.15.0-6.1 on GA media","description":"These are all security issues fixed in the libmozjs-115-0-115.15.0-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-29T00:00:00Z","modified":"2026-03-23T04:54:05.254239Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15679-1","title":"libmozjs-128-0-128.14.0-2.1 on GA media","description":"These are all security issues fixed in the libmozjs-128-0-128.14.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-29T00:00:00Z","modified":"2026-03-23T04:54:05.438244Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15688-1","title":"libmozjs-140-0-140.4.0-2.1 on GA media","description":"These are all security issues fixed in the libmozjs-140-0-140.4.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-30T00:00:00Z","modified":"2026-03-23T04:54:06.18469Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}