Bug 903758 (CVE-2022-4899)

Summary:	<app-arch/zstd-1.5.4: buffer overrun in CLI
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	base-system
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/facebook/zstd/issues/3200
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-04-04 04:30:03 UTC

CVE-2022-4899:

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Practically unexploitable, but useful to have a bug should anyone come
looking anyways.