9.8

CVE-2022-37434

Exploit
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zlib ≫ Zlib Version <= 1.2.12
Fedoraproject ≫ Fedora Version 35
Fedoraproject ≫ Fedora Version 36
Fedoraproject ≫ Fedora Version 37
Debian ≫ Debian Linux Version 10.0
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows
Netapp ≫ Hci Version -
Netapp ≫ Storagegrid Version -
Netapp ≫ Hci Compute Node Version -
Netapp ≫ H300s Firmware Version -
   Netapp ≫ H300s Version -
Netapp ≫ H500s Firmware Version -
   Netapp ≫ H500s Version -
Netapp ≫ H700s Firmware Version -
   Netapp ≫ H700s Version -
Netapp ≫ H700s Firmware Version -
   Netapp ≫ H700s Version -
Apple ≫ iPadOS Version < 15.7.1
Apple ≫ iPhone OS Version < 15.7.1
Apple ≫ iPhone OS Version >= 16.0 < 16.1
Apple ≫ macOS Version >= 11.0 < 11.7.1
Apple ≫ macOS Version >= 12.0.0 < 12.6.1
Apple ≫ watchOS Version < 9.1
Stormshield ≫ Stormshield Network Security Version >= 3.7.31 < 3.7.34
Stormshield ≫ Stormshield Network Security Version >= 3.11.0 < 3.11.22
Stormshield ≫ Stormshield Network Security Version >= 4.3.0 < 4.3.16
Stormshield ≫ Stormshield Network Security Version >= 4.6.0 < 4.6.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 17.85% 0.969
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.openwall.com/lists/oss-security/2022/08/05/2
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2022/08/09/1
Patch
Third Party Advisory
Mailing List
https://github.com/curl/curl/issues/9271
Third Party Advisory
Exploit
Issue Tracking
https://github.com/ivd38/zlib_overflow
Third Party Advisory
Exploit
https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20220901-0005/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230427-0007/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5218
Third Party Advisory
https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-202008.html
https://cert-portal.siemens.com/productcert/html/ssa-470355.html
http://seclists.org/fulldisclosure/2022/Oct/37
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2022/Oct/38
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2022/Oct/41
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2022/Oct/42
Third Party Advisory
Mailing List
https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063
Third Party Advisory
Exploit
https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764
Third Party Advisory
Exploit
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT213488
Third Party Advisory
https://support.apple.com/kb/HT213489
Third Party Advisory
https://support.apple.com/kb/HT213490
Third Party Advisory
https://support.apple.com/kb/HT213491
Third Party Advisory
https://support.apple.com/kb/HT213493
Third Party Advisory
https://support.apple.com/kb/HT213494
Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-150063.html
https://cert-portal.siemens.com/productcert/html/ssa-561322.html