CVE-2022-37434

Published: Aug 5, 2022Modified: Jul 14, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Affected (26)

Products: Zlib: Zlib · Fedoraproject: Fedora · Debian: Debian Linux · +3 more

Show all products

1 product

1 product

1 product

10 products

Active Iq Unified Manager

Hci

Hci Compute Node

Management Services For Element Software

Oncommand Workflow Automation

Ontap Select Deploy Administration Utility

4 products

1 product

Stormshield Network Security

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zlib Zlib	Up to 1.2.12

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36
Fedoraproject Fedora	Version 37

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Hci	All versions
Netapp Hci Compute Node	All versions
Netapp Management Services For Element Software	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Ontap Select Deploy Administration Utility	All versions
Netapp Storagegrid	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration I

6 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 15.7.1
Apple Iphone Os	Before 15.7.1
Apple Iphone Os	From 16.0 to 16.1
Apple Macos	From 11.0 to 11.7.1
Apple Macos	From 12.0.0 to 12.6.1
Apple Watchos	Before 9.1

Configuration J

4 vulnerable

Vulnerable Software	Affected Versions
Stormshield Stormshield Network Security	From 3.11.0 to 3.11.22
Stormshield Stormshield Network Security	From 3.7.31 to 3.7.34
Stormshield Stormshield Network Security	From 4.3.0 to 4.3.16
Stormshield Stormshield Network Security	From 4.6.0 to 4.6.3

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (59)

http://seclists.org/fulldisclosure/2022/Oct/37

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Oct/38

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Oct/41

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Oct/42

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/08/05/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/08/09/1

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://github.com/curl/curl/issues/9271

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/ivd38/zlib_overflow

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d

Source: cve@mitre.org

https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764

Source: cve@mitre.org

ExploitThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20220901-0005/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20230427-0007/

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT213488

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT213489

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT213490

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT213491

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT213493

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT213494

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5218

Source: cve@mitre.org

Third Party Advisory

http://seclists.org/fulldisclosure/2022/Oct/37