CVE-2014-125026: Out-of-bounds write in github.com/cloudflare/golz4
Published Dec 27, 2022
·Updated
LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.
Affected Software
2 affected componentsFixes available
Cloudflare Golz4 Go<2014-07-11
go/github.com/cloudflare/golz4<0.0.0-20140711154735-199f5f787806
0.0.0-20140711154735-199f5f787806
Remediation
Patch Available
Patch Available
Event History
Dec 27, 2022
CVE Published
via MITRE·09:13 PM
Data Sourced
via MITRE·09:13 PM
DescriptionWeakness
Dec 28, 2022
Advisory Published
via GitHub·12:30 AM
Frequently Asked Questions
1
What is CVE-2014-125026?
CVE-2014-125026 is a vulnerability in LZ4 bindings that could lead to arbitrary code execution.
2
How severe is CVE-2014-125026?
CVE-2014-125026 is classified as critical with a severity score of 9.8.
3
What software is affected by CVE-2014-125026?
Cloudflare Golz4 version up to and excluding 2014-07-11 is affected by CVE-2014-125026.
4
How can CVE-2014-125026 be exploited?
CVE-2014-125026 can be exploited by calling the LZ4 bindings with untrusted user input, leading to memory corruption and potential arbitrary code execution.
5
Is there a fix available for CVE-2014-125026?
Yes, a fix for CVE-2014-125026 is available. It can be found in the commit and GitHub issue linked in the references.