CVE-2022-4899: 
MySQL vulnerability analysis and mitigation

A vulnerability was discovered in zstd v1.4.10 (CVE-2022-4899), where an attacker can supply an empty string as an argument to the command line tool to cause a buffer overrun. The vulnerability was first reported on January 31, 2023 (CVE Details).

The vulnerability exists in the mallocAndJoin2Dir function within programs/util.c. When dir1Size=0 (i.e., dir1=""), the buffer access *(buffer - 1) results in an out-of-bounds read. The vulnerable code was introduced by commit 9a8ccd4b in version 1.4.6. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, NetApp Advisory).

Successful exploitation of this vulnerability could lead to a buffer overrun condition, potentially resulting in a crash of the application (Denial of Service). The impact is primarily on the availability of the system, with no direct impact on confidentiality or integrity (NetApp Advisory).

The vulnerability has been fixed in zstd version 1.5.4+dfsg2-5 and later releases. Users are advised to upgrade to the patched versions. For Debian systems, the fix is available in bookworm and later distributions (Debian Tracker).