CVE-2018-25032

Originalbeschreibung

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Betroffene Software

• Python ≥ 3.7.0 < 3.7.14≥ 3.8.0 < 3.8.14≥ 3.9.0 < 3.9.13≥ 3.10.0 < 3.10.5 Behoben in: 3.7.14, 3.8.14, 3.9.13, 3.10.5 exakte Übereinstimmung
• MariaDB ≥ 10.5.0 < 10.5.17≥ 10.3.0 < 10.3.36≥ 10.6.0 < 10.6.9≥ 10.9.0 < 10.9.2≥ 10.8.0 < 10.8.4≥ 10.7.0 < 10.7.5 Behoben in: 10.5.17, 10.3.36, 10.6.9, 10.9.2 exakte Übereinstimmung

Details

Veröffentlicht

2022-03-25

Zuletzt geändert

2026-10-14

CVSS-Vektor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-787

Referenzen

• cve.org/CVE-2018-25032
• nvd.nist.gov/vuln/detail/CVE-2018-25032
• seclists.org/fulldisclosure/2022/May/33
• seclists.org/fulldisclosure/2022/May/35
• seclists.org/fulldisclosure/2022/May/38
• www.openwall.com/lists/oss-security/2022/03/25/2
• www.openwall.com/lists/oss-security/2022/03/26/1
• cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
• github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
• github.com/madler/zlib/compare/v1.2.11...v1.2.12
• github.com/madler/zlib/issues/605
• lists.debian.org/debian-lts-announce/2022/04/msg00000.html
• lists.debian.org/debian-lts-announce/2022/05/msg00008.html
• lists.debian.org/debian-lts-announce/2022/09/msg00023.html