← back
CVE-2022-37434

CVE-2022-37434

CVSS 9.8 CRITICALEPSS 15.9%CWE-120
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 3
githubgithub.com/xen0bit/CVE-2022-37434_poc★ 3githubgithub.com/Trinadh465/external_zlib_android-6.0.1_r22_CVE-2022-37434★ 0githubgithub.com/Trinadh465/external_zlib_CVE-2022-37434★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://seclists.org/fulldisclosure/2022/Oct/37http://seclists.org/fulldisclosure/2022/Oct/38http://seclists.org/fulldisclosure/2022/Oct/41http://seclists.org/fulldisclosure/2022/Oct/42https://github.com/curl/curl/issues/9271https://github.com/ivd38/zlib_overflowhttps://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91dhttps://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764https://lists.debian.org/debian-lts-announce/2022/09/msg00012.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/