CVE-2017-8845

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blogs.gentoo.org/ago/2017/05/07/lrzip-invalid-memory-read-in-lzo_decompress_buf-stream-c/Third Party Advisory, VDB Entry
https://github.com/ckolivas/lrzip/issues/68Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202005-01Third Party Advisory
https://blogs.gentoo.org/ago/2017/05/07/lrzip-invalid-memory-read-in-lzo_decompress_buf-stream-c/Third Party Advisory, VDB Entry
https://github.com/ckolivas/lrzip/issues/68Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202005-01Third Party Advisory

Timeline

Published: May 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-88465.5The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and CVE-2017-88475.5The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL po CVE-2017-88486.5Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.CVE-2017-88497.8smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.CVE-2017-88505.9An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact tha CVE-2017-88515.9An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that bot CVE-2017-88527.8SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an un CVE-2017-88537.5Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the f CVE-2017-88547.8wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed CVE-2017-88557.5wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key.CVE-2017-88569.8In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution u CVE-2017-88579.8In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote comman