| packages: |
| - module: github.com/cloudflare/golz4 |
| symbols: |
| - Uncompress |
| versions: |
| - fixed: 0.0.0-20140711154735-199f5f787806 |
| description: | |
| LZ4 bindings use a deprecated C API that is vulnerable to |
| memory corruption, which could lead to arbitrary code execution |
| if called with untrusted user input. |
| published: 2021-04-14T20:04:52Z |
| credit: Yann Collet |
| cve_metadata: |
| id: CVE-2014-125026 |
| cwe: "CWE 94: Improper Control of Generation of Code ('Code Injection')" |
| links: |
| commit: https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898 |
| context: |
| - https://github.com/cloudflare/golz4/issues/5 |
