CVE-2019-11922

Published: Jul 25, 2019Modified: Jun 17, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

Affected (1)

Products: Facebook: Zstandard

Facebook

1 product

Zstandard

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Zstandard	Before 1.3.8

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (14)

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00008.html

Source: cve-assign@fb.com

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00062.html

Source: cve-assign@fb.com

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00078.html

Source: cve-assign@fb.com

https://github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0

Source: cve-assign@fb.com

PatchThird Party Advisory

https://usn.ubuntu.com/4108-1/

Source: cve-assign@fb.com

https://www.facebook.com/security/advisories/cve-2019-11922

Source: cve-assign@fb.com

Vendor Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve-assign@fb.com

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00008.html