CVE-2014-4607: 
Linux Debian vulnerability analysis and mitigation

The LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before version 2.07 contains an integer overflow vulnerability (CVE-2014-4607) that affects 32-bit platforms. This vulnerability was discovered in a compression algorithm that had been in use for 20 years, since its initial creation in 1994. The LZO algorithm, designed by Markus Oberhumer, has been widely implemented across various systems, including NASA's Mars Curiosity Rover, automotive systems, airplanes, and numerous open-source projects (SecurityMouse Blog).

The vulnerability occurs during the processing of a Literal Run in the LZO decompression algorithm. The integer overflow happens when the variable 't' is incremented by 255 for each nil byte (0x00) encountered in the compression payload. On 32-bit systems, approximately sixteen megabytes of zeroes can generate a sufficiently large value to trigger the overflow. The vulnerability manifests when evaluating the expression (t + 15), which can result in values between 0 and 14 through careful manipulation, bypassing buffer size checks (SecurityMouse Blog).

The impact varies depending on the specific implementation and platform. For FFmpeg and Libav implementations, remote code execution is practical across all architectures and platforms. For the Linux kernel's LZO implementation, denial of service and adjacent object overwrite are practical, though remote code execution is considered impractical. The vulnerability particularly affects projects using FFmpeg, Libav, and their dependencies, with special concern for systems that can process buffers of sixteen megabytes or more in a single decompression call (SecurityMouse Blog).

Vendors released patches to address this vulnerability. Users are advised to update to LZO version 2.07 or later. For systems using FFmpeg or Libav, immediate updates are strongly recommended. Users of MPlayer2 should disable the embedded media player plugin (gecko-mediaplayer) for their browsers until patches are applied. Systems that constrain buffer sizes to less than 16 megabytes (like ZFS's 128k limit) are inherently protected from exploitation (SecurityMouse Blog).