CVE-2022-37434

Advisory lineage Upstream: 0 Downstream: 27
Modified
Published: 05 Aug 2022, 00:00
Last modified:30 May 2025, 19:47

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
92.54% CRITICAL
93% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
4 found
Dark Web
Not detected

Timeline

05 Aug 2022, 00:00
Published
Vulnerability first disclosed
30 May 2025, 19:47
Last Modified
Vulnerability information updated

Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 92.54%• Percentile: 100%

Techniques & Countermeasures

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

  • CWE-120•Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

    The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected Systems

  • apple•ipados

    < 15.7.1

  • apple•iphone_os

    < 15.7.1 | ≥ 16.0, < 16.1

  • apple•macos

    ≥ 11.0, < 11.7.1 | ≥ 12.0.0, < 12.6.1

  • apple•watchos

    < 9.1

  • debian•debian_linux

    10.0

  • fedoraproject•fedora

    35 | 36 | 37

  • netapp•active_iq_unified_manager

    na

  • netapp•h300s_firmware

    na

  • netapp•h500s_firmware

    na

  • netapp•h700s_firmware

    na

  • netapp•hci

    na

  • netapp•hci_compute_node

    na

  • netapp•management_services_for_element_software

    na

  • netapp•oncommand_workflow_automation

    na

  • netapp•ontap_select_deploy_administration_utility

    na

  • netapp•storagegrid

    na

  • stormshield•stormshield_network_security

    ≥ 3.7.31, < 3.7.34 | ≥ 3.11.0, < 3.11.22 | ≥ 4.3.0, < 4.3.16 | ≥ 4.6.0, < 4.6.3

  • zlib•zlib

    ≤ 1.2.12

References (27)