CVE-2018-25032

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
VendorProductVersion
nokogirinokogiri
𝑥
< 1.13.4
zlibzlib
𝑥
< 1.2.12
debiandebian_linux
9.0
debiandebian_linux
10.0
debiandebian_linux
11.0
applemac_os_x
10.15 ≤
𝑥
< 10.15.7
applemac_os_x
10.15.7
applemac_os_x
10.15.7:security_update_2020
applemac_os_x
10.15.7:security_update_2020-001
applemac_os_x
10.15.7:security_update_2020-005
applemac_os_x
10.15.7:security_update_2020-007
applemac_os_x
10.15.7:security_update_2021-001
applemac_os_x
10.15.7:security_update_2021-002
applemac_os_x
10.15.7:security_update_2021-003
applemac_os_x
10.15.7:security_update_2021-006
applemac_os_x
10.15.7:security_update_2021-007
applemac_os_x
10.15.7:security_update_2021-008
applemac_os_x
10.15.7:security_update_2022-001
applemac_os_x
10.15.7:security_update_2022-002
applemac_os_x
10.15.7:security_update_2022-003
applemacos
11.0 ≤
𝑥
< 11.6.6
applemacos
12.0.0 ≤
𝑥
< 12.4
pythonpython
3.7.0 ≤
𝑥
< 3.7.14
pythonpython
3.8.0 ≤
𝑥
< 3.8.14
pythonpython
3.9.0 ≤
𝑥
< 3.9.13
pythonpython
3.10.0 ≤
𝑥
< 3.10.5
mariadbmariadb
10.3.0 ≤
𝑥
< 10.3.36
mariadbmariadb
10.4.0 ≤
𝑥
< 10.4.26
mariadbmariadb
10.5.0 ≤
𝑥
< 10.5.17
mariadbmariadb
10.6.0 ≤
𝑥
< 10.6.9
mariadbmariadb
10.7.0 ≤
𝑥
< 10.7.5
mariadbmariadb
10.8.0 ≤
𝑥
< 10.8.4
mariadbmariadb
10.9.0 ≤
𝑥
< 10.9.2
netappactive_iq_unified_manager
-
netappe-series_santricity_os_controller
11.0.0 ≤
𝑥
≤ 11.70.2
netappmanagement_services_for_element_software
-
netapponcommand_workflow_automation
-
netappontap_select_deploy_administration_utility
-
netapphci_compute_node
-
netapph300s_firmware
-
netapph500s_firmware
-
netapph700s_firmware
-
netapph410s_firmware
-
netapph410c_firmware
-
siemensscalance_sc622-2c_firmware
𝑥
< 3.0
siemensscalance_sc626-2c_firmware
𝑥
< 3.0
siemensscalance_sc632-2c_firmware
𝑥
< 3.0
siemensscalance_sc636-2c_firmware
𝑥
< 3.0
siemensscalance_sc642-2c_firmware
𝑥
< 3.0
siemensscalance_sc646-2c_firmware
𝑥
< 3.0
azulzulu
6.45
azulzulu
7.52
azulzulu
8.60
azulzulu
11.54
azulzulu
13.46
azulzulu
15.38
azulzulu
17.32
gotogotoassist
𝑥
< 11.9.18
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libz-mingw-w64
bullseye
no-dsa
buster
no-dsa
bookworm
1.2.13+dfsg-1
fixed
sid
1.3.1+dfsg-1
fixed
trixie
1.3.1+dfsg-1
fixed
zlib
bullseye (security)
1:1.2.11.dfsg-2+deb11u2
fixed
bullseye
1:1.2.11.dfsg-2+deb11u2
no-dsa
buster
no-dsa
bookworm
1:1.2.13.dfsg-1
fixed
sid
1:1.3.dfsg+really1.3.1-1
fixed
trixie
1:1.3.dfsg+really1.3.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
klibc
noble
Fixed 2.0.13-4ubuntu0.1
released
mantic
Fixed 2.0.13-1ubuntu0.1
released
jammy
Fixed 2.0.10-4ubuntu0.1
released
focal
Fixed 2.0.7-1ubuntu5.2
released
bionic
Fixed 2.0.4-9ubuntu2.2+esm1
released
xenial
Fixed 2.0.4-8ubuntu1.16.04.4+esm2
released
trusty
Fixed 2.0.3-0ubuntu1.14.04.3+esm3
released
mariadb-10.3
kinetic
dne
jammy
dne
focal
Fixed 1:10.3.37-0ubuntu0.20.04.1
released
bionic
dne
xenial
ignored
trusty
ignored
mariadb-10.6
noble
dne
kinetic
Fixed 1:10.6.9-1
released
jammy
Fixed 1:10.6.11-0ubuntu0.22.04.1
released
focal
dne
bionic
dne
xenial
ignored
trusty
ignored
rsync
noble
not-affected
mantic
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
focal
Fixed 3.1.3-8ubuntu0.3
released
bionic
Fixed 3.1.2-2.1ubuntu1.4
released
xenial
Fixed 3.1.1-3ubuntu1.3+esm1
released
trusty
not-affected
zlib
noble
Fixed 1:1.2.11.dfsg-2ubuntu9
released
mantic
Fixed 1:1.2.11.dfsg-2ubuntu9
released
kinetic
Fixed 1:1.2.11.dfsg-2ubuntu9
released
jammy
Fixed 1:1.2.11.dfsg-2ubuntu9
released
impish
Fixed 1:1.2.11.dfsg-2ubuntu7.1
released
focal
Fixed 1:1.2.11.dfsg-2ubuntu1.3
released
bionic
Fixed 1:1.2.11.dfsg-0ubuntu2.1
released
xenial
Fixed 1:1.2.8.dfsg-2ubuntu4.3+esm1
released
trusty
Fixed 1:1.2.8.dfsg-1ubuntu1.1+esm1
released
References