external_zlib-1.2.7_CVE-2018-25032

ZLIB 数据压缩库 zlib 1.2.7 是一个通用数据压缩库。所有代码都是线程安全的。zlib 库使用的数据格式在 RFC（请求评论）1950 到 1952 中描述，文件位于： http://tools.ietf.org/html/rfc1950（zlib 格式）、rfc1951（deflate 格式）和 rfc1952（gzip 格式）。 压缩库的所有函数都在文件 zlib.h 中说明（欢迎志愿者编写 man 页面，请联系 [email protected]）。库的使用示例在文件 test/example.c 中给出，该文件也测试库是否正常工作。另一个示例在文件...

Astra Linux – Vulnerability in zlib, libz-mingw-w64

Before version 1.2.12, zlib allowed memory corruption during deflation i.e., when compressing if the input contained many distant matches...

CVE-2024-3094-analysis

CVE-2024-3094 – 现实世界的供应链威胁 CVE-2024-3094 是什么？ CVE-2024-3094 是发现于 xz 压缩库中的一个重大后门漏洞。 它允许攻击者通过 SSH 远程执行代码。 该漏洞是被故意引入的，影响了许多 Linux 系统的关键部分。 本项目旨在了解发生了什么，后门如何工作，以及如何保持防护。 ⚠️ 为什么 CVE-2024-3094 危险？ 该漏洞极其危险，因为它允许攻击者未经授权访问受保护的系统——尤其是通过常用于远程服务器控制的 SSH。 使此案例更加严重的是，恶意代码被故意添加到非常流行的开源压缩库（xz）中。这表明有人战略性试图渗透大量系统。...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 暴露了 XZ 压缩库中的一个后门，允许通过绕过认证远程访问 SSH。这是一次重大的供应链攻击，影响 Linux 系统，突显了受信任开源组件中的风险。 XZ 后门：深入 Linux 服务器的供应链威胁 作者：Mark Mallia 这是什么 XZ 压缩库是许多现代 Linux 发行版的标准组件，成为了一次复杂供应链攻击的目标。 一个恶意代码片段被悄悄插入源代码树中，经过编译，并随每个新发布的 XZ 软件包传播。一旦安装，该后门可以从受感染主机打开一个 SSH 会话，连接到任何将其视为可信密钥的远程系统。 为何重要 供应链风险 –...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

UBUNTU-CVE-2026-87795

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the node:zlib synchronous APIs when a spoofed TypedArray byteLength triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra 4.0

Summary Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8....

perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob

A flaw was found in perl-IO-Compress, a component used for data compression and decompression. A remote attacker could exploit this vulnerability by crafting a malicious input, specifically an output glob, that bypasses the intended security measures. This could lead to the execution of...

[SECURITY] Fedora 44 Update: perl-Compress-Raw-Bzip2-2.218-1.fc44

This module provides a Perl interface to the bzip2 compression library. It is used by IO::Compress::Bzip2...

PT-2026-43487

Name of the Vulnerable Software and Affected Versions IO::Compress versions 2.207 through 2.219 Description The bundled zipdetails CLI tool crashes when processing an Info-ZIP Unix Extra Field tag 0x7875 where the UID Size or GID Size is set to 8. This occurs because the decode ux function trigge...

JLSEC-2026-478

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call...

JLSEC-2026-477

zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches...

CVE-2026-6535

Wireshark contains a vulnerability CVE-2026-6535 in its dissection engine where a zlib decompression crash is triggered by improper control of sequential memory allocation. Affected versions are Wireshark 4.6.0–4.6.4 and 4.4.0–4.4.14, leading to denial of service. The issue is described in the CV...

GHSA-4C3Q-X735-J3R5 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

Executive Summary This report documents a critical security research finding in the compressing npm package specifically tested on the latest v2.1.0. The core vulnerability is a Partial Fix Bypass of CVE-2026-24884. The current patch relies on a purely logical string validation within the...

CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but...

CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but...

AZL-81800 CVE-2026-34743 affecting package xz for versions less than 5.4.4-3

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindexappend would allocate too little...

CVE-2026-34743

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindexappend would allocate too little...