Snappy Java
Monthly
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
snappy-java is a fast compressor/decompressor for Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
snappy-java is a fast compressor/decompressor for Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
snappy-java is a fast compressor/decompressor for Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
snappy-java is a fast compressor/decompressor for Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
snappy-java is a fast compressor/decompressor for Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
snappy-java is a fast compressor/decompressor for Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.