CVE-2022-37434

Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

How to fix CVE-2022-37434

To remediate CVE-2022-37434, upgrade the affected package to a fixed version below.

• —upgrade to 1.2.11-r4 or later
• —upgrade to 2.0.6-r0 or later
• —no fix listed
• —upgrade to 1:1.2.11.dfsg-2+deb11u2 or later
• —upgrade to 1:1.2.11.dfsg-1+deb10u2 or later
• —upgrade to 1:1.2.11.dfsg-2+deb11u2 or later

Is CVE-2022-37434 being exploited?

Likely — EPSS is 92.5%, placing CVE-2022-37434 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (6)

• from 0, < 1.2.11-r4
• from 0, < 2.0.6-r0
• from 0
• from 0, < 1:1.2.11.dfsg-2+deb11u2
• from 0, < 1:1.2.11.dfsg-1+deb10u2
• from 0, < 1:1.2.11.dfsg-2+deb11u2

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2022-37434
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-37434