OPENSUSE-SU-2026:21902-1
Vulnerability from csaf_opensuse - Published: 2026-09-21 17:44 - Updated: 2026-09-24 17:48Summary
Security update for zstd-jni
Severity
Important
Notes
Title of the patch: Security update for zstd-jni
Description of the patch: This update for zstd-jni fixes the following issues:
- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).
- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).
Changes for zstd-jni:
- update to version v1.5.7.16.
Patchnames: openSUSE-Leap-16.0-1730
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.2 (High)
Affected products
Recommended
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-87823
Threats
Impact
important
7.7 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-87823
Threats
Impact
important
7.7 (High)
Affected products
Recommended
5 products, the same list as for
CVE-2026-87823
Threats
Impact
important
References
18 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for zstd-jni",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for zstd-jni fixes the following issues:\n\n- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).\n- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).\n- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).\n- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).\n\nChanges for zstd-jni:\n\n- update to version v1.5.7.16.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1730",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21902-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1279953",
"url": "https://bugzilla.suse.com/1279953"
},
{
"category": "self",
"summary": "SUSE Bug 1279954",
"url": "https://bugzilla.suse.com/1279954"
},
{
"category": "self",
"summary": "SUSE Bug 1279955",
"url": "https://bugzilla.suse.com/1279955"
},
{
"category": "self",
"summary": "SUSE Bug 1279956",
"url": "https://bugzilla.suse.com/1279956"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87823 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87823/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87824 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87824/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87825 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87825/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87877 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87877/"
}
],
"title": "Security update for zstd-jni",
"tracking": {
"current_release_date": "2026-09-24T17:48:12Z",
"generator": {
"date": "2026-09-21T17:44:10Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21902-1",
"initial_release_date": "2026-09-21T17:44:10Z",
"revision_history": [
{
"date": "2026-09-21T17:44:10Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-24T17:48:12Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"product": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"product_id": "zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/zstd-jni@1.5.7.16-160000.1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch",
"product": {
"name": "zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch",
"product_id": "zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/zstd-jni-javadoc@1.5.7.16-160000.1.1?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"product": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"product_id": "zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/zstd-jni@1.5.7.16-160000.1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"product": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"product_id": "zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/zstd-jni@1.5.7.16-160000.1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"product": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"product_id": "zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/zstd-jni@1.5.7.16-160000.1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64"
},
"product_reference": "zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le"
},
"product_reference": "zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x"
},
"product_reference": "zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "zstd-jni-0:1.5.7.16-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64"
},
"product_reference": "zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
},
"product_reference": "zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-87823",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87823"
}
],
"notes": [
{
"category": "general",
"text": "zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87823",
"url": "https://www.suse.com/security/cve/CVE-2026-87823"
},
{
"category": "external",
"summary": "SUSE Bug 1279953 for CVE-2026-87823",
"url": "https://bugzilla.suse.com/1279953"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-21T17:44:10Z",
"details": "important"
}
],
"title": "CVE-2026-87823"
},
{
"cve": "CVE-2026-87824",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87824"
}
],
"notes": [
{
"category": "general",
"text": "zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87824",
"url": "https://www.suse.com/security/cve/CVE-2026-87824"
},
{
"category": "external",
"summary": "SUSE Bug 1279956 for CVE-2026-87824",
"url": "https://bugzilla.suse.com/1279956"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-21T17:44:10Z",
"details": "important"
}
],
"title": "CVE-2026-87824"
},
{
"cve": "CVE-2026-87825",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87825"
}
],
"notes": [
{
"category": "general",
"text": "zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary\u0027s shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87825",
"url": "https://www.suse.com/security/cve/CVE-2026-87825"
},
{
"category": "external",
"summary": "SUSE Bug 1279955 for CVE-2026-87825",
"url": "https://bugzilla.suse.com/1279955"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-21T17:44:10Z",
"details": "important"
}
],
"title": "CVE-2026-87825"
},
{
"cve": "CVE-2026-87877",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87877"
}
],
"notes": [
{
"category": "general",
"text": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87877",
"url": "https://www.suse.com/security/cve/CVE-2026-87877"
},
{
"category": "external",
"summary": "SUSE Bug 1279954 for CVE-2026-87877",
"url": "https://bugzilla.suse.com/1279954"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.aarch64",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.ppc64le",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.s390x",
"openSUSE Leap 16.0:zstd-jni-0:1.5.7.16-160000.1.1.x86_64",
"openSUSE Leap 16.0:zstd-jni-javadoc-0:1.5.7.16-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-21T17:44:10Z",
"details": "important"
}
],
"title": "CVE-2026-87877"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…