CVE-2018-25032
high · 7.5zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
7.5
CVSS
51.7%
EPSS (exploit prob.)
99th
EPSS percentile
2022-03-25
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-787
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| nokogiri | nokogiri | < 1.13.4 |
| python | python | >= 3.7.0, < 3.7.14 |
| python | python | >= 3.8.0, < 3.8.14 |
| python | python | >= 3.9.0, < 3.9.13 |
| python | python | >= 3.10.0, < 3.10.5 |
| microsoft | windows | all versions |
| zlib | zlib | >= 1.2.2.2, < 1.2.12 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| fedoraproject | fedora | 34 |
| fedoraproject | fedora | 35 |
| fedoraproject | fedora | 36 |
| apple | mac_os_x | >= 10.15, < 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | macos | >= 11.0, < 11.6.6 |
| apple | macos | >= 12.0.0, < 12.4 |
| mariadb | mariadb | >= 10.3.0, < 10.3.36 |
| mariadb | mariadb | >= 10.4.0, < 10.4.26 |
| mariadb | mariadb | >= 10.5.0, < 10.5.17 |
| mariadb | mariadb | >= 10.6.0, < 10.6.9 |
| mariadb | mariadb | >= 10.7.0, < 10.7.5 |
| mariadb | mariadb | >= 10.8.0, < 10.8.4 |
| mariadb | mariadb | >= 10.9.0, < 10.9.2 |
| netapp | active_iq_unified_manager | all versions |
| netapp | e-series_santricity_os_controller | >= 11.0.0, <= 11.70.2 |
| netapp | management_services_for_element_software | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://seclists.org/fulldisclosure/2022/May/33
- http://seclists.org/fulldisclosure/2022/May/35
- http://seclists.org/fulldisclosure/2022/May/38
- http://www.openwall.com/lists/oss-security/2022/03/25/2
- http://www.openwall.com/lists/oss-security/2022/03/26/1
- https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
- https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
- https://github.com/madler/zlib/compare/v1.2.11...v1.2.12
- https://github.com/madler/zlib/issues/605
- https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html
- https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html
- https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/
- https://security.gentoo.org/glsa/202210-42
- https://security.netapp.com/advisory/ntap-20220526-0009/
- https://security.netapp.com/advisory/ntap-20220729-0004/
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213257
- https://www.debian.org/security/2022/dsa-5111
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-25032