{"schemaVersion":3,"id":"CVE-2002-0059","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a \"double free\"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.","dates":{"published":"2002-06-25T04:00:00.000Z","modified":"2024-08-08T02:35:17.400Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.09691,"percentile":0.95473,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.09691},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.09691,"percentile":0.95473}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.09691,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.09691,"percentile":0.95473}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-415","name":"Double Free","description":"The product calls free() twice on the same memory address.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/415.html"}],"affected":[{"vendor":"zlib","product":"zlib","name":"zlib","label":"zlib","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.1.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.1.3","eol":null,"hubHref":"/vendor/zlib/zlib"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.cert.org/advisories/CA-2002-07.html","label":"www.cert.org/advisories/CA-2002-07.html","hostname":"www.cert.org","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:022","label":"frontal2.mandriva.com/security/advisories?name=MDKSA-2002:022","hostname":"frontal2.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRAKE","Broken Link"]},{"url":"http://www.securityfocus.com/bid/4267","label":"www.securityfocus.com/bid/4267","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/8427","label":"exchange.xforce.ibmcloud.com/vulnerabilities/8427","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-030","label":"www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-030","hostname":"www1.itrc.hp.com","tags":["Vendor Advisory","X Refsource HP","Broken Link"]},{"url":"http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000469","label":"distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000469","hostname":"distro.conectiva.com.br","tags":["Vendor Advisory","X Refsource CONECTIVA","Broken Link"]},{"url":"http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-023.php","label":"www.linux-mandrake.com/en/security/2002/MDKSA-2002-023.php","hostname":"www.linux-mandrake.com","tags":["Vendor Advisory","X Refsource MANDRAKE","Broken Link","Patch"]},{"url":"http://www.debian.org/security/2002/dsa-122","label":"www.debian.org/security/2002/dsa-122","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Broken Link"]},{"url":"http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-024.php3","label":"www.linux-mandrake.com/en/security/2002/MDKSA-2002-024.php3","hostname":"www.linux-mandrake.com","tags":["Vendor Advisory","X Refsource MANDRAKE","Broken Link"]},{"url":"http://www.kb.cert.org/vuls/id/368819","label":"www.kb.cert.org/vuls/id/368819","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.redhat.com/support/errata/RHSA-2002-027.html","label":"www.redhat.com/support/errata/RHSA-2002-027.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Broken Link","Patch"]},{"url":"http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt","label":"www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt","hostname":"www.caldera.com","tags":["Vendor Advisory","X Refsource CALDERA","Broken Link"]},{"url":"http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-036","label":"www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-036","hostname":"www1.itrc.hp.com","tags":["Vendor Advisory","X Refsource HP","Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2002-026.html","label":"www.redhat.com/support/errata/RHSA-2002-026.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Broken Link","Patch"]},{"url":"http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-037","label":"www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-037","hostname":"www1.itrc.hp.com","tags":["Vendor Advisory","X Refsource HP","Broken Link"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2002-06-25T04:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-08T02:35:17.400Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T15:49:44.963Z","stale":false,"partial":false}}