Lucene search
CentOS ProjectCESA-2023:1095HistoryMar 08, 2023 - 4:30 p.m.
minizip, zlib security update
2023-03-0816:30:28
CentOS Project
lists.centos.org
237
centos
security advisory
zlib
data compression
cve
heap-based buffer
inflate
gzip header
security bulletin
minizip
upstream
red hat
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
71.6%
CentOS Errata and Security Advisory CESA-2023:1095
The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.
Security Fix(es):
- zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field (CVE-2022-37434)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2023-March/086387.html
Affected packages:
minizip
minizip-devel
zlib
zlib-devel
zlib-static
Upstream details at:
https://access.redhat.com/errata/RHSA-2023:1095
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| CentOS | 7 | i686 | minizip | < 1.2.7-21.el7_9 | minizip-1.2.7-21.el7_9.i686.rpm |
| CentOS | 7 | x86_64 | minizip | < 1.2.7-21.el7_9 | minizip-1.2.7-21.el7_9.x86_64.rpm |
| CentOS | 7 | i686 | minizip-devel | < 1.2.7-21.el7_9 | minizip-devel-1.2.7-21.el7_9.i686.rpm |
| CentOS | 7 | x86_64 | minizip-devel | < 1.2.7-21.el7_9 | minizip-devel-1.2.7-21.el7_9.x86_64.rpm |
| CentOS | 7 | i686 | zlib | < 1.2.7-21.el7_9 | zlib-1.2.7-21.el7_9.i686.rpm |
| CentOS | 7 | x86_64 | zlib | < 1.2.7-21.el7_9 | zlib-1.2.7-21.el7_9.x86_64.rpm |
| CentOS | 7 | i686 | zlib-devel | < 1.2.7-21.el7_9 | zlib-devel-1.2.7-21.el7_9.i686.rpm |
| CentOS | 7 | x86_64 | zlib-devel | < 1.2.7-21.el7_9 | zlib-devel-1.2.7-21.el7_9.x86_64.rpm |
| CentOS | 7 | i686 | zlib-static | < 1.2.7-21.el7_9 | zlib-static-1.2.7-21.el7_9.i686.rpm |
| CentOS | 7 | x86_64 | zlib-static | < 1.2.7-21.el7_9 | zlib-static-1.2.7-21.el7_9.x86_64.rpm |
Related
amazon
amazon
cbl_mariner
cbl_mariner
CVE-2022-37434 affecting package zlib 1.2.12-1
2022-08-24 22:05:05
CVE-2022-37434 affecting package zlib for versions less than 1.2.12-2
2022-09-13 22:36:39
redhatcve
redhatcve
CVE-2022-37434
2022-08-09 06:36:51
fedora
fedora
[SECURITY] Fedora 35 Update: zlib-1.2.11-32.fc35
2022-09-16 01:46:40
[SECURITY] Fedora 36 Update: zlib-1.2.11-33.fc36
2022-09-02 09:55:06
[SECURITY] Fedora 37 Update: zlib-1.2.12-5.fc37
2022-09-14 00:23:02
openvas
openvas
Ubuntu: Security Advisory (USN-5573-1)
2022-08-26 00:00:00
Huawei EulerOS: Security Advisory for zlib (EulerOS-SA-2022-2752)
2022-11-14 00:00:00
openSUSE: Security Advisory for zlib (SUSE-SU-2022:2947-1)
2022-09-01 00:00:00
nessus
nessus
AlmaLinux 8 : rsync (ALSA-2022:7793)
2022-11-14 00:00:00
AlmaLinux 8 : zlib (ALSA-2022:7106)
2022-10-25 00:00:00
EulerOS 2.0 SP5 : zlib (EulerOS-SA-2022-2715)
2022-11-04 00:00:00
suse
suse
Security update for zlib (important)
2022-08-31 00:00:00
Security update for zlib (important)
2022-09-01 00:00:00
oraclelinux
oraclelinux
rsync security and bug fix update
2022-11-22 00:00:00
zlib security update
2022-10-26 00:00:00
zlib security update
2022-11-09 00:00:00
osv
osv
zlib - security update
2022-08-25 00:00:00
Moderate: zlib security update
2022-10-25 00:00:00
CVE-2022-37434
2022-08-05 07:15:07
mageia
mageia
Updated zlib packages fix security vulnerability
2022-09-16 22:39:55
aix
aix
AIX is vulnerable to denial of service due to zlib and zlibNX
2023-07-25 11:05:17
cvelist
cvelist
CVE-2022-37434
2022-08-05 00:00:00
rocky
rocky
rsync security and enhancement update
2022-11-08 06:29:11
zlib security update
2022-11-02 13:50:56
zlib security update
2022-10-25 07:22:56
cloudfoundry
cloudfoundry
USN-5570-1: zlib vulnerability | Cloud Foundry
2023-01-19 00:00:00
USN-5573-1: rsync vulnerability | Cloud Foundry
2023-01-19 00:00:00
USN-5570-1: zlib vulnerability | Cloud Foundry
2022-08-25 00:00:00
cloudlinux
cloudlinux
Fixed CVE-2022-37434 in zlib
2022-08-17 18:47:33
Fixed CVE-2022-37434 in rsync
2022-08-25 15:56:39
veracode
veracode
Denial Of Service (DoS)
2022-08-09 02:04:05
githubexploit
githubexploit
Exploit for Out-of-bounds Write in Zlib
2022-09-30 10:20:36
Exploit for Out-of-bounds Write in Zlib
2022-09-14 07:28:23
Exploit for Out-of-bounds Write in Zlib
2024-02-02 14:25:28
f5
f5
K67213091 : Zlib vulnerability CVE-2022-37434
2022-10-21 00:00:00
ubuntu
ubuntu
zlib vulnerability
2022-10-17 00:00:00
zlib vulnerability
2022-08-17 00:00:00
rsync vulnerability
2022-08-18 00:00:00
almalinux
almalinux
Moderate: rsync security and enhancement update
2022-11-08 00:00:00
Moderate: rsync security and bug fix update
2022-11-15 00:00:00
Moderate: zlib security update
2022-10-25 00:00:00
debian
debian
[SECURITY] [DSA 5218-1] zlib security update
2022-08-25 19:51:59
[SECURITY] [DLA 3103-1] zlib security update
2022-09-12 09:01:16
debiancve
debiancve
CVE-2022-37434
2022-08-05 07:15:07
ibm
ibm
Security Bulletin: IBM Planning Analytics Workspace has addressed a vulnerability in GNU zlib (CVE-2022-37434)
2023-06-07 21:00:25
slackware
slackware
[slackware-security] zlib
2022-10-15 20:38:53
photon
photon
Critical Photon OS Security Update - PHSA-2022-0236
2022-08-23 00:00:00
redhat
redhat
(RHSA-2022:8291) Moderate: rsync security and bug fix update
2022-11-15 06:20:39
(RHSA-2024:0254) Moderate: rsync security update
2024-01-15 15:28:49
(RHSA-2023:1095) Moderate: zlib security update
2023-03-07 08:56:16
alpinelinux
alpinelinux
CVE-2022-37434
2022-08-05 07:15:07
redos
redos
ROS-20221207-01
2022-12-07 00:00:00
cgr
cgr
CVE-2022-37434 vulnerabilities
2024-05-19 03:07:16
freebsd_advisory
freebsd_advisory
FreeBSD-SA-22:13.zlib
2022-08-30 00:00:00
freebsd
freebsd
FreeBSD -- zlib heap buffer overflow
2022-08-30 00:00:00
qt
qt
Security advisory: zlib in Qt
2022-09-12 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2131
2023-03-14 14:13:27
wolfi
wolfi
CVE-2022-37434 vulnerabilities
2024-06-14 15:38:10
nvd
nvd
CVE-2022-37434
2022-08-05 07:15:07
prion
prion
Heap overflow
2022-08-05 07:15:00
ubuntucve
ubuntucve
CVE-2022-37434
2022-08-05 00:00:00
cve
cve
CVE-2022-37434
2022-08-05 07:15:07
gentoo
gentoo
zlib: Multiple vulnerabilities
2022-10-31 00:00:00
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
71.6%
Related for CESA-2023:1095