id: GO-2020-0022
modules:
    - module: github.com/cloudflare/golz4
      versions:
        - fixed: 0.0.0-20140711154735-199f5f787806
      vulnerable_at: 0.0.0-20140711153818-2dcef6a6aeec
      packages:
        - package: github.com/cloudflare/golz4
          symbols:
            - Uncompress
summary: Out-of-bounds write in github.com/cloudflare/golz4
description: |-
    LZ4 bindings use a deprecated C API that is vulnerable to memory corruption,
    which could lead to arbitrary code execution if called with untrusted user
    input.
published: 2021-04-14T20:04:52Z
ghsas:
    - GHSA-4wp2-8rm2-jgmh
credits:
    - Yann Collet
references:
    - fix: https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898
    - web: https://github.com/cloudflare/golz4/issues/5
cve_metadata:
    id: CVE-2014-125026
    cwe: 'CWE 94: Improper Control of Generation of Code (''Code Injection'')'
review_status: REVIEWED