CVEvulnerability

CVE-2022-37434

9.8 CRITICAL Published 2022-08-05 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2022-08-05
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-120, CWE-787

Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Affected configurations

• zlib zlib (<= 1.2.12) • fedoraproject fedora 35 • fedoraproject fedora 36 • fedoraproject fedora 37 • debian debian linux 10.0 • netapp active iq unified manager • netapp hci • netapp management services for element software • netapp oncommand workflow automation • netapp ontap select deploy administration utility • netapp storagegrid • netapp hci compute node • netapp h300s firmware • netapp h500s firmware • netapp h700s firmware • apple ipados (< 15.7.1) • apple iphone os (< 15.7.1) • apple iphone os (>= 16.0 < 16.1) • apple macos (>= 11.0 < 11.7.1) • apple macos (>= 12.0.0 < 12.6.1) • apple watchos (< 9.1) • stormshield stormshield network security (>= 3.7.31 < 3.7.34) • stormshield stormshield network security (>= 3.11.0 < 3.11.22) • stormshield stormshield network security (>= 4.3.0 < 4.3.16) • stormshield stormshield network security (>= 4.6.0 < 4.6.3)

Related

Weakness · CWE (2)

  • CWE-120 Buffer Copy without Checking Size of Input weakness
  • CWE-787 Out-of-bounds Write weakness

References