{"id":"openSUSE-SU-2019:2008-1","summary":"Security update for zstd","details":"This update for zstd fixes the following issues:\n\n- Update to version 1.4.2:\n  * bug: Fix bug in zstd-0.5 decoder by @terrelln (#1696)\n  * bug: Fix seekable decompression in-memory API by @iburinoc (#1695)\n  * bug: Close minor memory leak in CLI by @LeeYoung624 (#1701)\n  * misc: Validate blocks are smaller than size limit by @vivekmig (#1685)\n  * misc: Restructure source files by @ephiepark (#1679)\n\n- Update to version 1.4.1:\n  * bug: Fix data corruption in niche use cases by @terrelln (#1659)\n  * bug: Fuzz legacy modes, fix uncovered bugs by @terrelln (#1593, #1594, #1595)\n  * bug: Fix out of bounds read by @terrelln (#1590)\n  * perf: Improve decode speed by ~7% @mgrice (#1668)\n  * perf: Slightly improved compression ratio of level 3 and 4 (ZSTD_dfast) by @cyan4973 (#1681)\n  * perf: Slightly faster compression speed when re-using a context by @cyan4973 (#1658)\n  * perf: Improve compression ratio for small windowLog by @cyan4973 (#1624)\n  * perf: Faster compression speed in high compression mode for repetitive data by @terrelln (#1635)\n  * api: Add parameter to generate smaller dictionaries by @tyler-tran (#1656)\n  * cli: Recognize symlinks when built in C99 mode by @felixhandte (#1640)\n  * cli: Expose cpu load indicator for each file on -vv mode by @ephiepark (#1631)\n  * cli: Restrict read permissions on destination files by @chungy (#1644)\n  * cli: zstdgrep: handle -f flag by @felixhandte (#1618)\n  * cli: zstdcat: follow symlinks by @vejnar (#1604)\n  * doc: Remove extra size limit on compressed blocks by @felixhandte (#1689)\n  * doc: Fix typo by @yk-tanigawa (#1633)\n  * doc: Improve documentation on streaming buffer sizes by @cyan4973 (#1629)\n  * build: CMake: support building with LZ4 @leeyoung624 (#1626)\n  * build: CMake: install zstdless and zstdgrep by @leeyoung624 (#1647)\n  * build: CMake: respect existing uninstall target by @j301scott (#1619)\n  * build: Make: skip multithread tests when built without support by @michaelforney (#1620)\n  * build: Make: Fix examples/ test target by @sjnam (#1603)\n  * build: Meson: rename options out of deprecated namespace by @lzutao (#1665)\n  * build: Meson: fix build by @lzutao (#1602)\n  * build: Visual Studio: don't export symbols in static lib by @scharan (#1650)\n  * build: Visual Studio: fix linking by @absotively (#1639)\n  * build: Fix MinGW-W64 build by @myzhang1029 (#1600)\n  * misc: Expand decodecorpus coverage by @ephiepark (#1664)\n\n- Add baselibs.conf: libarchive gained zstd support and provides\n  -32bit libraries. This means, zstd also needs to provide -32bit\n  libs.\n\n- Update to new upstream release 1.4.0\n  * perf: level 1 compression speed was improved\n  * cli: added --[no-]compress-literals flag to enable or disable\n    literal compression\n- Reword 'real-time' in description by some actual statistics,\n  because 603MB/s (lowest zstd level) is not 'real-time' for\n  quite some applications.\n\n- zstd 1.3.8:\n  * better decompression speed on large files (+7%) and cold\n    dictionaries (+15%)\n  * slightly better compression ratio at high compression modes\n  * new --rsyncable mode\n  * support decompression of empty frames into NULL (used to be an\n    error)\n  * support ZSTD_CLEVEL environment variable\n  * --no-progress flag, preserving final summary\n  * various CLI fixes\n  * fix race condition in one-pass compression functions that could\n    allow out of bounds write (CVE-2019-11922, boo#1142941)\n\n- zstd 1.3.7:\n  * fix ratio for dictionary compression at levels 9 and 10\n  * add man pages for zstdless and zstdgrep\n- includes changes from zstd 1.3.6:\n  * faster dictionary builder, also the new default for --train\n  * previous (slower, slightly higher quality) dictionary builder\n    to be selected via --train-cover\n  * Faster dictionary decompression and compression under memory\n    limits with many dictionaries used simultaneously\n  * New command --adapt for compressed network piping of data\n    adjusted to the perceived network conditions\n\n- update to 1.3.5:\n  * much faster dictionary compression\n  * small quality improvement for dictionary generation\n  * slightly improved performance at high compression levels\n  * automatic memory release for long duration contexts\n  * fix overlapLog can be manually set\n  * fix decoding invalid lz4 frames\n  * fix performance degradation for dictionary compression when\n    using advanced API\n\n- fix pzstd tests\n- enable pzstd (parallel zstd)\n\n- Use %license instead of %doc [boo#1082318]\n- Add disk _constraints to fix ppc64le build\n- Use FAT LTO objects in order to provide proper static library (boo#1133297).\n\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","modified":"2026-03-11T07:32:12.231420Z","published":"2019-08-24T16:20:28Z","related":["CVE-2019-11922"],"upstream":["CVE-2019-11922"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K7K2UOXWEY5FAQGWUDI7235YCQ2R5UPH/#K7K2UOXWEY5FAQGWUDI7235YCQ2R5UPH"},{"type":"REPORT","url":"https://bugzilla.suse.com/1082318"},{"type":"REPORT","url":"https://bugzilla.suse.com/1133297"},{"type":"REPORT","url":"https://bugzilla.suse.com/1142941"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-11922"}],"affected":[{"package":{"name":"zstd","ecosystem":"SUSE:Package Hub 15","purl":"pkg:rpm/suse/zstd&distro=SUSE%20Package%20Hub%2015"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp151.4.3.1"}]}],"ecosystem_specific":{"binaries":[{"libzstd-devel-static":"1.4.2-bp151.4.3.1","libzstd-devel":"1.4.2-bp151.4.3.1","libzstd1-64bit":"1.4.2-bp151.4.3.1","libzstd1":"1.4.2-bp151.4.3.1","zstd":"1.4.2-bp151.4.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2019:2008-1.json"}},{"package":{"name":"zstd","ecosystem":"SUSE:Package Hub 15 SP1","purl":"pkg:rpm/suse/zstd&distro=SUSE%20Package%20Hub%2015%20SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-bp151.4.3.1"}]}],"ecosystem_specific":{"binaries":[{"libzstd1-64bit":"1.4.2-bp151.4.3.1","libzstd1":"1.4.2-bp151.4.3.1","zstd":"1.4.2-bp151.4.3.1","libzstd-devel-static":"1.4.2-bp151.4.3.1","libzstd-devel":"1.4.2-bp151.4.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2019:2008-1.json"}}],"schema_version":"1.7.5"}