CVE-2014-4608: Canonical Ubuntu Linux

High severity, CVSS 7.3. EPSS: 5.4% chance of exploitation in the next 30 days.

Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype.

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 14.04 only; version 14.10 only
• Linux Linux Kernel: before 3.15.2 (fixed in 3.15.2)
• Opensuse Opensuse: version 11.4 only
• Suse Linux Enterprise Real Time Extension: version 11 only
• Suse Linux Enterprise Server: version 11 only

Published 2014-07-03. Last modified 2026-06-17.