[SECURITY] [DLA 3103-1] zlib security update

2022-09-1209:00:53

lists.debian.org

zlib

cve-2022-37434

debian

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.003

Percentile

71.6%

JSON

Debian LTS Advisory DLA-3103-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
September 12, 2022 https://wiki.debian.org/LTS

Package : zlib
Version : 1:1.2.11.dfsg-1+deb10u2
CVE ID : CVE-2022-37434
Debian Bug : 1016710

Evgeny Legerov reported a heap-based buffer overflow vulnerability in
the inflate operation in zlib, which could result in denial of service
or potentially the execution of arbitrary code if specially crafted
input is processed.

For Debian 10 buster, this problem has been fixed in version
1:1.2.11.dfsg-1+deb10u2.

We recommend that you upgrade your zlib packages.

For the detailed security status of zlib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/zlib

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11armhfzlib1g-udeb< 1:1.2.11.dfsg-2+deb11u2zlib1g-udeb_1:1.2.11.dfsg-2+deb11u2_armhf.deb
Debian11armhfzlib1g-dbgsym< 1:1.2.11.dfsg-2+deb11u2zlib1g-dbgsym_1:1.2.11.dfsg-2+deb11u2_armhf.deb
Debian11allzlib< 1:1.2.11.dfsg-2+deb11u2zlib_1:1.2.11.dfsg-2+deb11u2_all.deb
Debian11amd64lib32z1-dev< 1:1.2.11.dfsg-2+deb11u2lib32z1-dev_1:1.2.11.dfsg-2+deb11u2_amd64.deb
Debian11mipsellibn32z1-dev< 1:1.2.11.dfsg-2+deb11u2libn32z1-dev_1:1.2.11.dfsg-2+deb11u2_mipsel.deb
Debian11arm64zlib1g< 1:1.2.11.dfsg-2+deb11u2zlib1g_1:1.2.11.dfsg-2+deb11u2_arm64.deb
Debian10i386zlib1g-dev< 1:1.2.11.dfsg-1+deb10u2zlib1g-dev_1:1.2.11.dfsg-1+deb10u2_i386.deb
Debian11mips64elzlib1g-udeb< 1:1.2.11.dfsg-2+deb11u2zlib1g-udeb_1:1.2.11.dfsg-2+deb11u2_mips64el.deb
Debian11ppc64elzlib1g-dbgsym< 1:1.2.11.dfsg-2+deb11u2zlib1g-dbgsym_1:1.2.11.dfsg-2+deb11u2_ppc64el.deb
Debian10arm64zlib1g< 1:1.2.11.dfsg-1+deb10u2zlib1g_1:1.2.11.dfsg-1+deb10u2_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	armhf	zlib1g-udeb	< 1:1.2.11.dfsg-2+deb11u2	zlib1g-udeb_1:1.2.11.dfsg-2+deb11u2_armhf.deb
Debian	11	armhf	zlib1g-dbgsym	< 1:1.2.11.dfsg-2+deb11u2	zlib1g-dbgsym_1:1.2.11.dfsg-2+deb11u2_armhf.deb
Debian	11	all	zlib	< 1:1.2.11.dfsg-2+deb11u2	zlib_1:1.2.11.dfsg-2+deb11u2_all.deb
Debian	11	amd64	lib32z1-dev	< 1:1.2.11.dfsg-2+deb11u2	lib32z1-dev_1:1.2.11.dfsg-2+deb11u2_amd64.deb
Debian	11	mipsel	libn32z1-dev	< 1:1.2.11.dfsg-2+deb11u2	libn32z1-dev_1:1.2.11.dfsg-2+deb11u2_mipsel.deb
Debian	11	arm64	zlib1g	< 1:1.2.11.dfsg-2+deb11u2	zlib1g_1:1.2.11.dfsg-2+deb11u2_arm64.deb
Debian	10	i386	zlib1g-dev	< 1:1.2.11.dfsg-1+deb10u2	zlib1g-dev_1:1.2.11.dfsg-1+deb10u2_i386.deb
Debian	11	mips64el	zlib1g-udeb	< 1:1.2.11.dfsg-2+deb11u2	zlib1g-udeb_1:1.2.11.dfsg-2+deb11u2_mips64el.deb
Debian	11	ppc64el	zlib1g-dbgsym	< 1:1.2.11.dfsg-2+deb11u2	zlib1g-dbgsym_1:1.2.11.dfsg-2+deb11u2_ppc64el.deb
Debian	10	arm64	zlib1g	< 1:1.2.11.dfsg-1+deb10u2	zlib1g_1:1.2.11.dfsg-1+deb10u2_arm64.deb