Veracode Vulnerability DatabaseVERACODE:40946Integer Overflow
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
39.5%
snappy-java is vulnerable to Integer Overflow. The vulnerability exists because the shuffle functions of BitShuffle.java does not properly check multiplication results if its zero, too small or a negative value or not which cause java.lang.NegativeArraySizeException and java.lang.ArrayIndexOutOfBoundsException exceptions, leading to an application crash.
| CPE | Name | Operator | Version |
|---|---|---|---|
| snappy-java | eq | 1.1.3-M1 | |
| snappy-java | le | 1.1.10.0 | |
| snappy-java | eq | 1.1.3-M1 | |
| snappy-java | le | 1.1.10.0 |
References
github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/BitShuffle.java#L107
github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/BitShuffle.java
github.com/xerial/snappy-java/commit/820e2e074c58748b41dbd547f4edba9e108ad905
github.com/xerial/snappy-java/security/advisories/GHSA-pqr6-cmr2-h8hf
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
39.5%