Compress Lzf
Monthly
Out-of-bounds memory access in the ning compress-lzf library before version 1.2.0 lets crafted LZF streams make the default sun.misc.Unsafe-based UnsafeChunkDecoder read beyond its decompression buffer, leaking unrelated JVM heap contents into decompressed output or crashing the JVM. Any application that feeds untrusted, attacker-supplied LZF data to the default LZFDecoder is exposed without authentication or user interaction, while applications decompressing only trusted internal data are largely unaffected. The issue was fixed upstream by improved bounds checks in version 1.2.0; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds memory access in the ning compress-lzf library before version 1.2.0 lets crafted LZF streams make the default sun.misc.Unsafe-based UnsafeChunkDecoder read beyond its decompression buffer, leaking unrelated JVM heap contents into decompressed output or crashing the JVM. Any application that feeds untrusted, attacker-supplied LZF data to the default LZFDecoder is exposed without authentication or user interaction, while applications decompressing only trusted internal data are largely unaffected. The issue was fixed upstream by improved bounds checks in version 1.2.0; no public exploit code or active exploitation has been confirmed at time of analysis.