Solution
Please Install the Updated Packages.
Insight
LZO is a portable lossless data compression library written in ANSI C.
An integer overflow flaw was found in the way the lzo library decompressed certain archives compressed with the LZO algorithm. An attacker could create a specially crafted LZO-compressed input that, when decompressed by an application using the lzo library, would cause that application to crash or, potentially, execute arbitrary code. (CVE-2014-4607)
Red Hat would like to thank Don A. Bailey from Lab Mouse Security for reporting this issue.
All lzo users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all services linked to the lzo library must be restarted or the system rebooted.
Affected
lzo on CentOS 6
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2014-4607 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities