INFSA-2025:11035: lz4 security update

Information about definition

Identificator: INFSA-2025:11035

Type: security

Release date: 2025-07-25 10:34:57 UTC

Information about package

The lz4 packages provide support for LZ4, a very fast, lossless compression algorithm that provides compression speeds of 400 MB/s per core and scales with multicore CPUs. It also features an extremely fast decoder that reaches speeds of multiple GB/s per core and typically reaches RAM speed limits on multicore systems.

Vulnerabilities description

  • CVE-2019-17543

    LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
no information 8.1 no information
Critical, important, moderate, low

Updated packages