EXPOSURES › CVE-2021-3520
CVE-2021-3520
CRITICAL
DETAIL
SourceNVD · cve
Published2021-06-02
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2021-3520 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendorSplunk · vendorlz4 project · vendoractive iq unified manager · productcloud backup · productcommunications cloud native core policy · productlz4 · productontap select deploy administration utility · productuniversal forwarder · productzfs storage appliance kit · product
DESCRIPTION
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
AFFECTED FEDRAMP PRODUCTS · 13
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Splunk Cloud Platform for FedRAMP High Splunk |
In Process |
| Splunk Cloud Platform for FedRAMP Moderate Splunk |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |