Most recent entries from all

2NGA002579 — ABB Arctic communication solution ARM600 Vulnerabilities

ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of the product or insert and run arbitrary code. As part of ABB product lifecycle policy, once a product transitions to end-of-life, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document, such as using a private APN cellular network between Arctic wireless gateways and ARM600 for establishing VPN tunnels, to mitigate security risks and avoid potential vulnerabilities. As part of ABB product lifecycle policy, once a product transitions to Limited state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document to mitigate security risks.

ALSA-2022:7106 — Moderate: zlib security update

Affected: AlmaLinux:8: zlib, AlmaLinux:8: zlib-devel, AlmaLinux:8: zlib-static

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.

Security Fix(es):

* zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-05325

Withdrawn: BELL-CVE-2022-37434 — CVE-2022-37434 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-1019 — De multiples vulnérabilités ont été découvertes dans Nessus. Elles permettent à un attaquant de provoquer un problème d…

certfr-2022-avi-1019

CLEANSTART-2026-DU98063 — Security fix for CVE-2022-37434 applied in: zlib 1.2.12-r2

Affected: CleanStart: zlib

Security vulnerability affects the zlib package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-336235

fkie_cve-2022-37434

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

GHSA-cfmr-vrgj-vqwv

gsd-2022-37434

ICSA-23-005-03 — Hitachi Energy Lumada Asset Performance Management

The affected versions of Lumada APM rely on a version of OpenSSL that contains a buffer overflow vulnerability. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. In Lumada APM, this can be triggered by configuring APM to connect to a malicious server for one of the supported integrations. This may cause a crash of the specific APM service implementing the integration (causing a denial of service).CVE-2022-3602 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected versions of Lumada APM rely on a version of OpenSSL that contains a buffer overflow vulnerability. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. In Lumada APM, this can be triggered by configuring APM to connect to a malicious server for one of the supported integrations. This may cause a…

msrc_CVE-2022-37434 — zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…

msrc_CVE-2022-37434

NCSC-2026-0229 — Kwetsbaarheden verholpen in Siemens producten

NCSC-2026-0229

OESA-2022-1843 — zlib security update

Affected: openEuler:20.03-LTS-SP1: zlib, openEuler:20.03-LTS-SP3: zlib, openEuler:22.03-LTS: zlib

Zlib is a free, general-purpose, not covered by any patents, lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Security Fix(es): zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).(CVE-2022-37434)

openSUSE-SU-2022:2947-1 — Security update for zlib

Security update for zlib

RHSA-2024:0254 — Red Hat Security Advisory: rsync security update

zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field

SSA-202008 — SSA-202008: Multiple Vulnerabilities in Ruggedcom Rox Before V2.17.0

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…

SUSE-SU-2022:2845-1 — Security update for zlib

Security update for zlib

UBUNTU-CVE-2022-37434

Affected: Ubuntu:Pro:14.04:LTS: klibc, Ubuntu:Pro:14.04:LTS: zlib, Ubuntu:Pro:16.04:LTS: klibc, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: zlib, Ubuntu:18.04:LTS: rsync, Ubuntu:18.04:LTS: zlib, Ubuntu:Pro:18.04:LTS: klibc, Ubuntu:20.04:LTS: klibc, Ubuntu:20.04:LTS: rsync and 4 more

VDE-2023-001 — PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware

A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.

WID-SEC-W-2022-0929 — zlib: Schwachstelle ermöglicht nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in zlib ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.