Login Request a demo
High severity · published Jul 25, 2019
CVE-2019-11922
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than…
8.1
CVSS
1.4%
EPSS
No
On KEV
Description
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZS
Zstandard · Facebook
before 1.3.8 · source: NVD
Affected product
ZS
Zstandard
Facebook
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11922
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00008.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00062.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00078.html
Patch
https://github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0
usn.ubuntu.com
https://usn.ubuntu.com/4108-1/
Vendor Advisory
https://www.facebook.com/security/advisories/cve-2019-11922
More from Zstandard
7.5
CVE-2022-4899
A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun
5.5
CVE-2021-24031
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions
4.7
CVE-2021-24032
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and…