CVE-2018-11498
Last modified
CVE-2018-11498 is a vulnerability of currently unknown severity. In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file, as well as achieve remote code execution.. EPSS estimates a 2.01% chance of exploitation in the next 30 days.
Description
In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file, as well as achieve remote code execution.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lizard Project | Lizard | 1.0 |
| Lizard Project | Lz5 | 2.0 |
References
- https://github.com/inikep/lizard/issues/16Third Party Advisory
- https://github.com/inikep/lizard/issues/16Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-11498?
How severe is CVE-2018-11498?
How do I fix CVE-2018-11498?
Are you affected by CVE-2018-11498?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST