Affected: AlmaLinux:8: zlib, AlmaLinux:8: zlib-devel, AlmaLinux:8: zlib-static

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.

Security Fix(es):

* zlib: A flaw found in zlib when compressing (not decompressing) certain inputs (CVE-2018-25032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn by the publisher.

Affected: Homebrew: mikutter

zlib 1.2.11 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Affected: CleanStart: zlib

Security vulnerability affects the zlib package. This issue is resolved in later releases. See references for vulnerability details.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Affected: RubyGems: nokogiri

zlib 1.2.11 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. A malicious server can serve excessive amounts of "Set-Cookie:" headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on "foo.example.com" can set cookies that also would match for "bar.example.com", making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb",…

Affected: openEuler:20.03-LTS-SP1: zlib, openEuler:20.03-LTS-SP3: zlib, openEuler:22.03-LTS: zlib

Zlib is a free, general-purpose, not covered by any patents, lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Security Fix(es): zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.(CVE-2018-25032)

Security update for mupdf

zlib: A flaw found in zlib when compressing (not decompressing) certain inputs

CADRA is affected by multiple zlib and Foxit vulnerabilities.

Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Recommended update for mariadb104

Affected: Ubuntu:Pro:14.04:LTS: klibc, Ubuntu:Pro:14.04:LTS: zlib, Ubuntu:Pro:16.04:LTS: klibc, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: zlib, Ubuntu:18.04:LTS: rsync, Ubuntu:18.04:LTS: zlib, Ubuntu:Pro:18.04:LTS: klibc, Ubuntu:20.04:LTS: klibc, Ubuntu:20.04:LTS: mariadb-10.3 and 6 more

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

UPDATE A: Two devices (ENERGY AXC PU, SMARTRTU AXC SG) added (24.11.2022) Update for PLCnext Firmware containing fixes for recent vulnerability findings in Linux components and security enhancements. PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in zlib ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.