Critical · published May 23, 2017
⚠️ A sneaky little flaw in zlib could allow clever attackers to exploit improper pointer arithmetic — like figuring out how to replace the ingredient list on a recipe! Think of zlib like a restaurant kitchen, where the chef needs to follow a precise recipe. If a mischievous cook can manipulate the measurements improperly, they might ruin the dish, or worse, serve something completely different without anyone noticing! This vulnerability could lead to unexpected behaviors or even crashes in applications relying on zlib, potentially allowing attackers to create havoc within your system's operations. While the severity isn't classified, any opening for exploitation should be taken seriously!
Think of zlib like a restaurant kitchen, where the chef needs to follow a precise recipe. If a mischievous cook can manipulate the measurements improperly, they might ruin the dish, or worse, serve something completely different without anyone noticing! The issue stems from improper pointer arithmetic in inffast.c of zlib 1.2.8, which could enable context-dependent attacks under specific circumstances, leading to undefined behavior.
This vulnerability could lead to unexpected behaviors or even crashes in applications relying on zlib, potentially allowing attackers to create havoc within your system's operations. While the severity isn't classified, any opening for exploitation should be taken seriously! To stay safe, consider upgrading zlib to the latest version available, ensuring that any dependencies are also checked. Regularly audit your code to identify where zlib might be in use and apply best practices for input validation. You've got this! Stay vigilant and by following these steps, you can keep your systems running smoothly and securely. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zlib/zlib | ≥ 1.2.0, < 1.2.9 | 1.2.9 |
| opensuse/leap | all versions | — |
| opensuse/leap | all versions | — |
| opensuse/opensuse | all versions | — |
| debian/debian_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| oracle/database_server | all versions | — |
| oracle/jdk | all versions | — |
| oracle/jdk | all versions | — |
| oracle/jdk | all versions | — |
| oracle/jre | all versions | — |
| oracle/jre | all versions | — |
| oracle/jre | all versions | — |
| oracle/mysql | ≥ 5.5.0, ≤ 5.5.61 | — |
| oracle/mysql | ≥ 5.6.0, ≤ 5.6.41 | — |
| oracle/mysql | ≥ 5.7.0, ≤ 5.7.23 | — |
| oracle/mysql | ≥ 8.0.0, ≤ 8.0.12 | — |
| redhat/satellite | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| apple/iphone_os | < 11 | 11 |
| apple/mac_os_x | ≥ 10.0.0, < 10.13.0 | 10.13.0 |
| apple/tvos | < 11.0 | 11.0 |
| apple/watchos | < 4 | 4 |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/cloud_backup | all versions | — |
| netapp/e-series_santricity_management | all versions | — |
| netapp/e-series_santricity_management | all versions | — |
| netapp/e-series_santricity_management | all versions | — |
| netapp/e-series_santricity_os_controller | ≥ 11.0.0, ≤ 11.70.1 | — |
| netapp/e-series_santricity_storage_manager | all versions | — |
| netapp/e-series_santricity_web_services | all versions | — |
| netapp/oncommand_balance | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_performance_manager | all versions | — |
| netapp/oncommand_shift | all versions | — |
| netapp/oncommand_unified_manager | ≤ 7.1 | — |
| netapp/oncommand_unified_manager | ≤ 7.1 | — |
| netapp/oncommand_unified_manager | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/snapmanager | all versions | — |
| netapp/snapmanager | all versions | — |
| netapp/solidfire | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| netapp/storage_replication_adapter_for_clustered_data_ontap | all versions | — |
| netapp/symantec_netbackup | all versions | — |
| netapp/vasa_provider_for_clustered_data_ontap | ≥ 7.2 | — |
| netapp/virtual_storage_console | all versions | — |
| netapp/hci_storage_node | all versions | — |
| nodejs/node.js | ≥ 4.0.0, ≤ 4.1.2 | — |
| nodejs/node.js | ≥ 4.2.0, < 4.8.2 | 4.8.2 |
| nodejs/node.js | ≥ 6.0.0, ≤ 6.8.1 | — |
| nodejs/node.js | ≥ 6.9.0, < 6.10.2 | 6.10.2 |
| nodejs/node.js | ≥ 7.0.0, < 7.6.0 | 7.6.0 |