Critical · published August 5, 2022
🔥 A heap-based buffer over-read in zlib could mean a memory mishap that opens the door for chaos, but only if your app calls `inflateGetHeader`! Think of it like a cooking recipe that suddenly asks for an ingredient you don’t have—without the proper checks, your kitchen could overflow into a culinary disaster! An attacker exploiting this could read sensitive memory or even crash the application, leading to potentially devastating downtime and data exposure. With a CVSS score of 9.8, this isn't just a small issue; it could bring critical operations to a halt! ⚠️
Think of it like a cooking recipe that suddenly asks for an ingredient you don’t have—without the proper checks, your kitchen could overflow into a culinary disaster! The vulnerability exists due to improper handling of large gzip header extra fields in zlib 1.2.12's `inflate.c`, specifically when applications invoke `inflateGetHeader`. This flaw can lead to a buffer over-read or overflow during the inflation process.
An attacker exploiting this could read sensitive memory or even crash the application, leading to potentially devastating downtime and data exposure. With a CVSS score of 9.8, this isn't just a small issue; it could bring critical operations to a halt! ⚠️ To protect your applications, make sure to update zlib to the latest version that patches this vulnerability. Additionally, review any applications that bundle zlib, especially those that interact with gzip headers, and ensure they are capable of safely handling input. 🛡️ You've got this! Fixing this vulnerability means you're one step closer to a more secure environment! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| zlib/zlib | ≤ 1.2.12 | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/hci | all versions | — |
| netapp/management_services_for_element_software | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| netapp/storagegrid | all versions | — |
| netapp/hci_compute_node | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| apple/ipados | < 15.7.1 | 15.7.1 |
| apple/iphone_os | < 15.7.1 | 15.7.1 |
| apple/iphone_os | ≥ 16.0, < 16.1 | 16.1 |
| apple/macos | ≥ 11.0, < 11.7.1 | 11.7.1 |
| apple/macos | ≥ 12.0.0, < 12.6.1 | 12.6.1 |
| apple/watchos | < 9.1 | 9.1 |
| stormshield/stormshield_network_security | ≥ 3.7.31, < 3.7.34 | 3.7.34 |
| stormshield/stormshield_network_security | ≥ 3.11.0, < 3.11.22 | 3.11.22 |
| stormshield/stormshield_network_security | ≥ 4.3.0, < 4.3.16 | 4.3.16 |
| stormshield/stormshield_network_security | ≥ 4.6.0, < 4.6.3 | 4.6.3 |