Vulnerability in lrzip - Security Update
Summary
DSA-5145-1: lrzip - security update. Affects lrzip versions < 0.631+git180528-1+deb10u1. Fixed in 0.631+git180528-1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lrzip is a compression program that is used to reduce the size of files. It is commonly used in Debian distributions, specifically in versions 10 (buster) and 11 (bullseye). The lrzip program utilizes various compression algorithms to achieve high compression ratios. However, multiple vulnerabilities have been discovered in lrzip that could potentially lead to denial of service or the execution of arbitrary code.
Vulnerability Detail
The vulnerabilities in lrzip have been identified as CVE-2021-27345, CVE-2020-25467, and CVE-2021-27347. These vulnerabilities could be exploited by attackers to cause a denial of service or execute arbitrary code on systems running lrzip. The specific technical details of these vulnerabilities have not been provided in the report.
How To Fix
Minimum fixed version
0.631+git180528-1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lrzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned in the report.
Conclusion
lrzip has been found to have multiple vulnerabilities that could lead to denial of service or the execution of arbitrary code. It is crucial to upgrade the lrzip packages to the fixed versions to ensure the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lrzip →
FAQ
lrzip is a compression program used to reduce the size of files.
The vulnerabilities in lrzip are CVE-2021-27345, CVE-2020-25467, and CVE-2021-27347.
These vulnerabilities could result in denial of service or the execution of arbitrary code.
To fix these vulnerabilities, upgrade the lrzip packages to the fixed versions: 0.631+git180528-1+deb10u1 for Debian 10 (buster) and 0.641-1+deb11u1 for Debian 11 (bullseye).
No specific workaround has been mentioned in the report.
Related vulnerabilities
Recent vulnerabilities recorded for lrzip.
