CVE-2022-37434
CVE-2022-37434
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
CVSS 9.8 · Critical · EPSS 19.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Unknown
No fix published
libz-mingw-w64 Debian:12
- Affected ranges
- ECOSYSTEM: < 1.2.12+dfsg-2
Update to 1.2.12+dfsg-2
libz-mingw-w64 Debian:13
- Affected ranges
- ECOSYSTEM: < 1.2.12+dfsg-2
Update to 1.2.12+dfsg-2
libz-mingw-w64 Debian:14
- Affected ranges
- ECOSYSTEM: < 1.2.12+dfsg-2
Update to 1.2.12+dfsg-2
zlib Debian:12
- Affected ranges
- ECOSYSTEM: < 1:1.2.11.dfsg-4.1
Update to 1:1.2.11.dfsg-4.1
zlib Debian:13
- Affected ranges
- ECOSYSTEM: < 1:1.2.11.dfsg-4.1
Update to 1:1.2.11.dfsg-4.1
zlib Debian:14
- Affected ranges
- ECOSYSTEM: < 1:1.2.11.dfsg-4.1
Update to 1:1.2.11.dfsg-4.1
klibc Ubuntu:Pro:14.04:LTS
- Versions
- 2.0.1-3.1ubuntu2
- 2.0.2-1ubuntu1
- 2.0.2-1ubuntu2
- 2.0.3-0ubuntu1
- 2.0.3-0ubuntu1.14.04.1
- 2.0.3-0ubuntu1.14.04.2
- 2.0.3-0ubuntu1.14.04.3
- 2.0.3-0ubuntu1.14.04.3+esm2
- Affected ranges
- ECOSYSTEM: < 2.0.3-0ubuntu1.14.04.3+esm3
Update to 2.0.3-0ubuntu1.14.04.3+esm3
zlib Ubuntu:Pro:14.04:LTS
- Versions
- 1:1.2.8.dfsg-1ubuntu1
- 1:1.2.8.dfsg-1ubuntu1.1
- 1:1.2.8.dfsg-1ubuntu1.1+esm1
- Affected ranges
- ECOSYSTEM: < 1:1.2.8.dfsg-1ubuntu1.1+esm2
Update to 1:1.2.8.dfsg-1ubuntu1.1+esm2
klibc Ubuntu:Pro:16.04:LTS
- Versions
- 2.0.3-0ubuntu1
- 2.0.4-4
- 2.0.4-6
- 2.0.4-7
- 2.0.4-8
- 2.0.4-8ubuntu1
- 2.0.4-8ubuntu1.16.04.1
- 2.0.4-8ubuntu1.16.04.2
- 2.0.4-8ubuntu1.16.04.3
- 2.0.4-8ubuntu1.16.04.4
- 2.0.4-8ubuntu1.16.04.4+esm1
- Affected ranges
- ECOSYSTEM: < 2.0.4-8ubuntu1.16.04.4+esm2
Update to 2.0.4-8ubuntu1.16.04.4+esm2
rsync Ubuntu:Pro:16.04:LTS
- Versions
- 3.1.1-3
- 3.1.1-3ubuntu1
- 3.1.1-3ubuntu1.1
- 3.1.1-3ubuntu1.2
- 3.1.1-3ubuntu1.3
- 3.1.1-3ubuntu1.3+esm1
- Affected ranges
- ECOSYSTEM: < 3.1.1-3ubuntu1.3+esm2
Update to 3.1.1-3ubuntu1.3+esm2
zlib Ubuntu:Pro:16.04:LTS
- Versions
- 1:1.2.8.dfsg-2ubuntu4
- 1:1.2.8.dfsg-2ubuntu4.1
- 1:1.2.8.dfsg-2ubuntu4.3
- 1:1.2.8.dfsg-2ubuntu4.3+esm1
- Affected ranges
- ECOSYSTEM: < 1:1.2.8.dfsg-2ubuntu4.3+esm2
Update to 1:1.2.8.dfsg-2ubuntu4.3+esm2
rsync Ubuntu:18.04:LTS
- Versions
- 3.1.2-2
- 3.1.2-2.1
- 3.1.2-2.1ubuntu1
- 3.1.2-2.1ubuntu1.1
- 3.1.2-2.1ubuntu1.2
- 3.1.2-2.1ubuntu1.3
- 3.1.2-2.1ubuntu1.4
- Affected ranges
- ECOSYSTEM: < 3.1.2-2.1ubuntu1.5
Update to 3.1.2-2.1ubuntu1.5
zlib Ubuntu:18.04:LTS
- Versions
- 1:1.2.11.dfsg-0ubuntu2
- 1:1.2.11.dfsg-0ubuntu2.1
- Affected ranges
- ECOSYSTEM: < 1:1.2.11.dfsg-0ubuntu2.2
Update to 1:1.2.11.dfsg-0ubuntu2.2
klibc Ubuntu:Pro:18.04:LTS
- Versions
- 2.0.4-9ubuntu1
- 2.0.4-9ubuntu2
- 2.0.4-9ubuntu2.1
- 2.0.4-9ubuntu2.2
- Affected ranges
- ECOSYSTEM: < 2.0.4-9ubuntu2.2+esm1
Update to 2.0.4-9ubuntu2.2+esm1
klibc Ubuntu:20.04:LTS
- Versions
- 2.0.6-1ubuntu1
- 2.0.6-1ubuntu2
- 2.0.7-1ubuntu1
- 2.0.7-1ubuntu3
- 2.0.7-1ubuntu4
- 2.0.7-1ubuntu5
- 2.0.7-1ubuntu5.1
- Affected ranges
- ECOSYSTEM: < 2.0.7-1ubuntu5.2
Update to 2.0.7-1ubuntu5.2
rsync Ubuntu:20.04:LTS
- Versions
- 3.1.3-6
- 3.1.3-8
- 3.1.3-8ubuntu0.1
- 3.1.3-8ubuntu0.2
- 3.1.3-8ubuntu0.3
- Affected ranges
- ECOSYSTEM: < 3.1.3-8ubuntu0.4
Update to 3.1.3-8ubuntu0.4
zlib Ubuntu:20.04:LTS
- Versions
- 1:1.2.11.dfsg-1ubuntu3
- 1:1.2.11.dfsg-2ubuntu1
- 1:1.2.11.dfsg-2ubuntu1.1
- 1:1.2.11.dfsg-2ubuntu1.2
- 1:1.2.11.dfsg-2ubuntu1.3
- 1:1.2.11.dfsg-2ubuntu1.4
- Affected ranges
- ECOSYSTEM: < 1:1.2.11.dfsg-2ubuntu1.5
Update to 1:1.2.11.dfsg-2ubuntu1.5
klibc Ubuntu:22.04:LTS
- Versions
- 2.0.8-6.1ubuntu2
- 2.0.10-3
- 2.0.10-4
- Affected ranges
- ECOSYSTEM: < 2.0.10-4ubuntu0.1
Update to 2.0.10-4ubuntu0.1
zlib Ubuntu:22.04:LTS
- Versions
- 1:1.2.11.dfsg-2ubuntu7
- 1:1.2.11.dfsg-2ubuntu9
- 1:1.2.11.dfsg-2ubuntu9.1
- Affected ranges
- ECOSYSTEM: < 1:1.2.11.dfsg-2ubuntu9.2
Update to 1:1.2.11.dfsg-2ubuntu9.2
klibc Ubuntu:24.04:LTS
- Versions
- 2.0.13-1
- 2.0.13-2
- 2.0.13-2ubuntu1
- 2.0.13-4
- Affected ranges
- ECOSYSTEM: < 2.0.13-4ubuntu0.1
Update to 2.0.13-4ubuntu0.1
Original sources
- https://github.com/ivd38/zlib_overflow
- https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1
- https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063
- https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764
- http://www.openwall.com/lists/oss-security/2022/08/05/2
- https://github.com/curl/curl/issues/9271
- http://www.openwall.com/lists/oss-security/2022/08/09/1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/
- https://www.debian.org/security/2022/dsa-5218
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/
- https://security.netapp.com/advisory/ntap-20220901-0005/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/
- https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/
- https://support.apple.com/kb/HT213489
- https://support.apple.com/kb/HT213488
- https://support.apple.com/kb/HT213494
- https://support.apple.com/kb/HT213493
- https://support.apple.com/kb/HT213491
- https://support.apple.com/kb/HT213490
- http://seclists.org/fulldisclosure/2022/Oct/41
- http://seclists.org/fulldisclosure/2022/Oct/38
- https://nvd.nist.gov/vuln/detail/CVE-2022-37434