CVE-2022-26291

lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted Irz file.

Published: Mar 29, 2022
Updated: Apr 14, 2023
CVE: CVE-2022-26291
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.5
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-416

Affected Software
References

Software	From	Fixed in
long_range_zip_project / long_range_zip	0.641	0.641.x
debian / debian_linux	9.0	9.0.x
debian / debian_linux	10.0	10.0.x
debian / debian_linux	11.0	11.0.x

https://github.com/ckolivas/lrzip/issues/206
https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html
https://www.debian.org/security/2022/dsa-5145

Vulnerability Database

CVE-2022-26291