Logo
›
›vulnerability›CVE-2018-25032
Name
CVE-2018-25032
Source
NVD ( link)Debian ( link)
Description
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
CWEs
CWE-787 CWE-787
Published Date
Updated Date
Workaround
-
Advisories
http://seclists.org/fulldisclosure/2022/May/33Mailing List
http://seclists.org/fulldisclosure/2022/May/35Mailing List
http://seclists.org/fulldisclosure/2022/May/38Mailing List
http://www.openwall.com/lists/oss-security/2022/03/25/2Mailing List
http://www.openwall.com/lists/oss-security/2022/03/26/1Exploit
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfThird Party Advisory
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531Patch
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12Patch
https://github.com/madler/zlib/issues/605Issue Tracking
https://lists.debian.org/debian-lts-announce/2022/04/msg00000.htmlMailing List
https://lists.debian.org/debian-lts-announce/2022/05/msg00008.htmlMailing List
https://lists.debian.org/debian-lts-announce/2022/09/msg00023.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/Third Party Advisory
https://security.gentoo.org/glsa/202210-42Third Party Advisory
https://security.netapp.com/advisory/ntap-20220526-0009/Third Party Advisory
https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
https://support.apple.com/kb/HT213255Third Party Advisory
https://support.apple.com/kb/HT213256Third Party Advisory
https://support.apple.com/kb/HT213257Third Party Advisory
https://www.debian.org/security/2022/dsa-5111Patch
https://www.openwall.com/lists/oss-security/2022/03/24/1Mailing List
https://www.openwall.com/lists/oss-security/2022/03/28/1Exploit
https://www.openwall.com/lists/oss-security/2022/03/28/3Mailing List
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch
http://seclists.org/fulldisclosure/2022/May/33Mailing List
http://seclists.org/fulldisclosure/2022/May/35Mailing List
http://seclists.org/fulldisclosure/2022/May/38Mailing List
http://www.openwall.com/lists/oss-security/2022/03/25/2Mailing List
http://www.openwall.com/lists/oss-security/2022/03/26/1Exploit
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfThird Party Advisory
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531Patch
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12Patch
https://github.com/madler/zlib/issues/605Issue Tracking
https://lists.debian.org/debian-lts-announce/2022/04/msg00000.htmlMailing List
https://lists.debian.org/debian-lts-announce/2022/05/msg00008.htmlMailing List
https://lists.debian.org/debian-lts-announce/2022/09/msg00023.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/Third Party Advisory
https://security.gentoo.org/glsa/202210-42Third Party Advisory
https://security.netapp.com/advisory/ntap-20220526-0009/Third Party Advisory
https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
https://support.apple.com/kb/HT213255Third Party Advisory
https://support.apple.com/kb/HT213256Third Party Advisory
https://support.apple.com/kb/HT213257Third Party Advisory
https://www.debian.org/security/2022/dsa-5111Patch
https://www.openwall.com/lists/oss-security/2022/03/24/1Mailing List
https://www.openwall.com/lists/oss-security/2022/03/28/1Exploit
https://www.openwall.com/lists/oss-security/2022/03/28/3Mailing List
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch

Analysis#

Affected Component
Analysis
zlib
Patched

Vulnerability Ratings#

7.5
CVSSv31
7.5
CVSSv31
5
CVSSv2
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
libzlib
buildroot
2025.02.x
1.3.2
Not Affected
libzlib
buildroot
master
1.3.2
Not Affected
zlib
openwrt
master
1.3.2-r1
Not Affected
zlib
openwrt
openwrt-25.12
1.3.1-r1
Not Affected
zlib
yocto
master
1.3.2
Not Affected
zlib
yocto
scarthgap
1.3.1
Not Affected

Resolved with patches#

zlib (yocto:kirkstone)

#
Title
Author
Resolve
1
Fix a bug that can crash deflate on some input when using
Mark Adler <madler@alumni.caltech.edu>
CVE-2018-25032