CVE-2023-39741: 
Linux Debian vulnerability analysis and mitigation

lrzip v0.651 was discovered to contain a heap overflow vulnerability in the libzpaq::PostProcessor::write(int) function located in /libzpaq/libzpaq.cpp. The vulnerability was reported on August 1, 2023, and affects the Long Range Zip (lrzip) compression utility (MITRE CVE, NVD).

The vulnerability is a heap-based buffer overflow that occurs in the libzpaq::PostProcessor::write(int) function at line 1208 of libzpaq/libzpaq.cpp. The issue manifests when writing beyond the bounds of a 428-byte heap-allocated region. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) condition through the processing of a specially crafted file. The heap buffer overflow can lead to application crashes and potential memory corruption (GitHub Issue).

According to the Debian Security Tracker, this vulnerability has been fixed in versions after 0.651-3. Users running affected versions should upgrade to a patched version when available (Debian Tracker).