Vulnerability Description
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zlib | Zlib | <= 1.2.12 |
| Fedoraproject | Fedora | 35 |
| Debian | Debian Linux | 10.0 |
| Netapp | Active Iq Unified Manager | - |
| Netapp | Hci | - |
| Netapp | Management Services For Element Software | - |
| Netapp | Oncommand Workflow Automation | - |
| Netapp | Ontap Select Deploy Administration Utility | - |
| Netapp | Storagegrid | - |
| Netapp | Hci Compute Node | - |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Apple | Ipados | < 15.7.1 |
| Apple | Iphone Os | < 15.7.1 |
| Apple | Macos | >= 11.0, < 11.7.1 |
| Apple | Watchos | < 9.1 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2022/Oct/37Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/38Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/41Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/42Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/08/05/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/08/09/1Mailing ListPatchThird Party Advisory
- https://github.com/curl/curl/issues/9271ExploitIssue TrackingThird Party Advisory
- https://github.com/ivd38/zlib_overflowExploitThird Party Advisory
- https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zliExploitThird Party Advisory
- https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
- https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1PatchThird Party Advisory
- https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/depExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00012.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
FAQ
What is CVE-2022-37434?
CVE-2022-37434 is a vulnerability with a CVSS score of 9.8 (CRITICAL). zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. S...
How severe is CVE-2022-37434?
CVE-2022-37434 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-37434?
Check the references section above for vendor advisories and patch information. Affected products include: Zlib Zlib, Fedoraproject Fedora, Debian Debian Linux, Netapp Active Iq Unified Manager, Netapp Hci.