Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-37434

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Published

2022-08-05T07:15:07.240

Last Modified

2025-05-30T20:15:30.030

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Primary
    CWE-787
  • Type: Secondary
    CWE-120
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zlib zlib ≤ 1.2.12 Yes
Operating System fedoraproject fedora 35 Yes
Operating System fedoraproject fedora 36 Yes
Operating System fedoraproject fedora 37 Yes
Operating System debian debian_linux 10.0 Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
Application netapp hci - Yes
Application netapp management_services_for_element_software - Yes
Application netapp oncommand_workflow_automation - Yes
Application netapp ontap_select_deploy_administration_utility - Yes
Application netapp storagegrid - Yes
Hardware netapp hci_compute_node - Yes
Operating System netapp h300s_firmware - Yes
Hardware netapp h300s - No
Operating System netapp h500s_firmware - Yes
Hardware netapp h500s - No
Operating System netapp h700s_firmware - Yes
Hardware netapp h700s - No
Operating System netapp h700s_firmware - Yes
Hardware netapp h700s - No
Operating System apple ipados < 15.7.1 Yes
Operating System apple iphone_os < 15.7.1 Yes
Operating System apple iphone_os < 16.1 Yes
Operating System apple macos < 11.7.1 Yes
Operating System apple macos < 12.6.1 Yes
Operating System apple watchos < 9.1 Yes
Application stormshield stormshield_network_security < 3.7.34 Yes
Application stormshield stormshield_network_security < 3.11.22 Yes
Application stormshield stormshield_network_security < 4.3.16 Yes
Application stormshield stormshield_network_security < 4.6.3 Yes
References