Withdrawn by the publisher.

Affected: CleanStart: spark-sc213-jdk17-py312

Multiple security vulnerabilities affect the spark-sc213-jdk17-py312 package. zstd-jni versions before 1. See references for individual vulnerability details.

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

zstd-jni-1.5.7.16-1.1 on GA media

Security update for zstd-jni

Affected: Ubuntu:24.04:LTS: zstd-jni-java, Ubuntu:26.04:LTS: zstd-jni-java

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.