CVE-2018-25032

Description

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

CVSS breakdown

Affected products

• Apple / macOS11.0 – 11.6.6
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• azul / zulu7.52 – 7.52
• azul / zulu17.32 – 17.32
• azul / zulu15.38 – 15.38
• azul / zulu13.46 – 13.46
• azul / zulu11.54 – 11.54
• azul / zulu8.60 – 8.60
• azul / zulu6.45 – 6.45
• debian / debian_linux10.0 – 10.0
• debian / debian_linux9.0 – 9.0
• debian / debian_linux11.0 – 11.0
• fedoraproject / fedora36 – 36
• fedoraproject / fedora35 – 35
• fedoraproject / fedora34 – 34
• goto / gotoassist11.9.18
• MariaDB / MariaDB10.3.0 – 10.3.36
• NETAPP / active_iq_unified_manager
• NETAPP / e-series_santricity_os_controller11.0.0 – 11.70.2
• NETAPP / h300s_firmware
• NETAPP / h410c_firmware
• NETAPP / h410s_firmware
• NETAPP / h500s_firmware
• NETAPP / h700s_firmware
• NETAPP / hci_compute_node
• NETAPP / management_services_for_element_software
• NETAPP / OnCommand Workflow Automation
• NETAPP / ONTAP Select Deploy administration utility
• nokogiri / nokogiri1.13.4
• Python / python3.7.0 – 3.7.14
• Siemens / scalance_sc622-2c_firmware3.0
• Siemens / scalance_sc626-2c_firmware3.0
• Siemens / scalance_sc632-2c_firmware3.0
• Siemens / scalance_sc636-2c_firmware3.0
• Siemens / scalance_sc642-2c_firmware3.0
• Siemens / scalance_sc646-2c_firmware3.0
• zlib / zlib1.2.2.2 – 1.2.12

References

• MAILING_LISThttps://www.openwall.com/lists/oss-security/2022/03/24/1
• PATCHhttps://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
• MAILING_LISThttp://www.openwall.com/lists/oss-security/2022/03/25/2
• MAILING_LISThttp://www.openwall.com/lists/oss-security/2022/03/26/1
• VENDOR_ADVISORYhttps://www.debian.org/security/2022/dsa-5111
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/04/msg00000.html
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/05/msg00008.html
• MAILING_LISThttp://seclists.org/fulldisclosure/2022/May/33
• MAILING_LISThttp://seclists.org/fulldisclosure/2022/May/35
• MAILING_LISThttp://seclists.org/fulldisclosure/2022/May/38
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html
• MAILING_LISThttps://www.openwall.com/lists/oss-security/2022/03/28/3
• MAILING_LISThttps://www.openwall.com/lists/oss-security/2022/03/28/1
• MISChttps://github.com/madler/zlib/compare/v1.2.11...v1.2.12
• MISChttps://github.com/madler/zlib/issues/605
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT213257
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT213256
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT213255
• MISChttps://security.netapp.com/advisory/ntap-20220526-0009/
• MISChttps://security.netapp.com/advisory/ntap-20220729-0004/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
• MISChttps://security.gentoo.org/glsa/202210-42
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf