CVE-2022-37434
קריטית 9.8
תיאור (מקור, אנגלית)
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
מדדים
- CVSS 3.1
-
9.8 (CRITICAL)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE
- CWE-787, CWE-120
מוצרים מושפעים
zlib: zlib; fedoraproject: fedora; debian: debian linux; netapp: active iq unified manager; netapp: hci; netapp: management services for element software; netapp: oncommand workflow automation; netapp: ontap select deploy administration utility; netapp: storagegrid; netapp: hci compute node; netapp: h300s firmware; netapp: h300s; netapp: h500s firmware; netapp: h500s; netapp: h700s firmware
קישורים
- http://www.openwall.com/lists/oss-security/2022/08/09/1 Mailing ListPatchThird Party Advisory
- https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1 PatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/08/09/1 Mailing ListPatchThird Party Advisory
- https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1 PatchThird Party Advisory
- https://github.com/curl/curl/issues/9271 ExploitIssue TrackingThird Party Advisory
- https://github.com/ivd38/zlib_overflow ExploitThird Party Advisory
- https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/z… ExploitThird Party Advisory
- https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/d… ExploitThird Party Advisory
- https://github.com/curl/curl/issues/9271 ExploitIssue TrackingThird Party Advisory
- https://github.com/ivd38/zlib_overflow ExploitThird Party Advisory