CVE-2023-39741: 
Linux Debian vulnerability analysis and mitigation

lrzip v0.651 was discovered to contain a heap overflow vulnerability in the libzpaq::PostProcessor::write(int) function located in /libzpaq/libzpaq.cpp. The vulnerability was reported on August 1, 2023, and affects the Long Range Zip (lrzip) compression utility (MITRE CVE, NVD).

The vulnerability is a heap-based buffer overflow that occurs in the libzpaq::PostProcessor::write(int) function at line 1208 of libzpaq/libzpaq.cpp. The issue manifests when writing beyond the bounds of a 428-byte heap-allocated region. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) condition through the processing of a specially crafted file. The heap buffer overflow can lead to application crashes and potential memory corruption (GitHub Issue).

The vulnerability can be triggered by processing a maliciously crafted file using the lrzip utility with the -t (test) option. A proof of concept exploit has been publicly disclosed and is available (POC).

According to the Debian Security Tracker, this vulnerability has been fixed in versions after 0.651-3. Users running affected versions should upgrade to a patched version when available (Debian Tracker).