CVE-2022-37434

CVSS 9.8 - CRITICAL

Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Affected Products

Vendor	Product	Version
zlib	zlib	`All versions`
fedoraproject	fedora	`35`
fedoraproject	fedora	`36`
fedoraproject	fedora	`37`
debian	debian_linux	`10.0`
netapp	active_iq_unified_manager	`-`
netapp	active_iq_unified_manager	`-`
netapp	hci	`-`
netapp	management_services_for_element_software	`-`
netapp	oncommand_workflow_automation	`-`
netapp	ontap_select_deploy_administration_utility	`-`
netapp	storagegrid	`-`
netapp	hci_compute_node	`-`
netapp	h300s_firmware	`-`
netapp	h300s	`-`
netapp	h500s_firmware	`-`
netapp	h500s	`-`
netapp	h700s_firmware	`-`
netapp	h700s	`-`
netapp	h700s_firmware	`-`
netapp	h700s	`-`
apple	ipados	`All versions`
apple	iphone_os	`All versions`
apple	iphone_os	`All versions`
apple	macos	`All versions`
apple	macos	`All versions`
apple	watchos	`All versions`
stormshield	stormshield_network_security	`All versions`
stormshield	stormshield_network_security	`All versions`
stormshield	stormshield_network_security	`All versions`
stormshield	stormshield_network_security	`All versions`