Most recent entries from all

ALSA-2022:1642 — Important: zlib security update

Affected: AlmaLinux:8: zlib, AlmaLinux:8: zlib-devel, AlmaLinux:8: zlib-static

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.

Security Fix(es):

* zlib: A flaw found in zlib when compressing (not decompressing) certain inputs (CVE-2018-25032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-01641

Withdrawn: BELL-CVE-2018-25032 — CVE-2018-25032 does not affect BellSoft software

Withdrawn by the publisher.

BREW-mikutter-CVE-2018-25032 — Nokogiri affected by zlib's Out-of-bounds Write vulnerability

Affected: Homebrew: mikutter

zlib 1.2.11 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

certfr-2022-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta…

certfr-2022-avi-1094

CLEANSTART-2026-ID64471 — Security fix for CVE-2018-25032 applied in: zlib 1.2.11-r4

Affected: CleanStart: zlib

Security vulnerability affects the zlib package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-336232

fkie_cve-2018-25032

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

GHSA-jc36-42cf-vqwj — Nokogiri affected by zlib's Out-of-bounds Write vulnerability

Affected: RubyGems: nokogiri

zlib 1.2.11 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

gsd-2018-25032

ICSA-22-349-18 — Siemens SCALANCE SC-600 Family

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. A malicious server can serve excessive amounts of "Set-Cookie:" headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on "foo.example.com" can set cookies that also would match for "bar.example.com", making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb",…

msrc_CVE-2018-25032 — zlib before 1.2.12 allows memory corruption when deflating (i.e. when compressing) if the input has many distant matche…

msrc_CVE-2018-25032

NCSC-2026-0229 — Kwetsbaarheden verholpen in Siemens producten

NCSC-2026-0229

OESA-2022-1651 — zlib security update

Affected: openEuler:20.03-LTS-SP1: zlib, openEuler:20.03-LTS-SP3: zlib, openEuler:22.03-LTS: zlib

Zlib is a free, general-purpose, not covered by any patents, lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Security Fix(es): zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.(CVE-2018-25032)

openSUSE-SU-2022:10126-1 — Security update for mupdf

Security update for mupdf

RHSA-2022:1591 — Red Hat Security Advisory: zlib security update

zlib: A flaw found in zlib when compressing (not decompressing) certain inputs

SSA-470355 — SSA-470355: Zlib and Foxit Vulnerabilities in CADRA

CADRA is affected by multiple zlib and Foxit vulnerabilities.

Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

SUSE-RU-2023:3956-1 — Recommended update for mariadb104

Recommended update for mariadb104

UBUNTU-CVE-2018-25032

Affected: Ubuntu:Pro:14.04:LTS: klibc, Ubuntu:Pro:14.04:LTS: zlib, Ubuntu:Pro:16.04:LTS: klibc, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: zlib, Ubuntu:18.04:LTS: rsync, Ubuntu:18.04:LTS: zlib, Ubuntu:Pro:18.04:LTS: klibc, Ubuntu:20.04:LTS: klibc, Ubuntu:20.04:LTS: mariadb-10.3 and 6 more

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

VDE-2022-046 — PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware

UPDATE A: Two devices (ENERGY AXC PU, SMARTRTU AXC SG) added (24.11.2022) Update for PLCnext Firmware containing fixes for recent vulnerability findings in Linux components and security enhancements. PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.

WID-SEC-W-2022-0005 — zlib: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in zlib ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.