CVE-2014-125026

CVSS V2 None CVSS V3 None

Description

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

Overview

CVE ID
CVE-2014-125026

Assigner
security@golang.org

Vulnerability Status
Analyzed

Published Version
2022-12-27T22:15:10

Last Modified Date
2023-01-06T15:24:30

Weakness Enumerations

CWE	URL
CWE-787	http://cwe.mitre.org/data/definitions/787.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:cloudflare:golz4::::::go::*	1	OR		2014-07-11

References

Reference URL	Reference Tags
https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898
https://github.com/cloudflare/golz4/issues/5
https://pkg.go.dev/vuln/GO-2020-0022

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2014-125026
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-125026

History

Created	Old Value	New Value	Data Type	Notes
2022-12-27 23:14:47				Added to TrackCVE
2022-12-28 12:14:45		2022-12-28T10:18:56	CVE Modified Date	updated
2022-12-28 12:14:45	Received	Awaiting Analysis	Vulnerability Status	updated
2023-01-04 16:17:12	Awaiting Analysis	Undergoing Analysis	Vulnerability Status	updated
2023-01-06 16:20:20		2023-01-06T15:24:30	CVE Modified Date	updated
2023-01-06 16:20:20	Undergoing Analysis	Analyzed	Vulnerability Status	updated
2023-01-06 16:20:20			Weakness Enumeration	new
2023-01-06 16:20:21			CPE Information	updated