Every CVE Search/ Get API key

CVE-2023-6992

Memory corruption issues is Cloudflare zlib implementation

4.0 MediumFix available

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.24%Up 0.2 points since Jan 10, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.0

Memory corruption issues is Cloudflare zlib implementation

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
CVE-2023-6992
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-20, CWE-122, CWE-126
Updated
2026-11-02
EUVDEUVD-2023-59184 4.0

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
EUVD-2023-59184
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-03
NVD 4.0

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
CVE-2023-6992
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-122, CWE-126, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2023-6992 5.5

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
ALPINE-CVE-2023-6992
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-43663 5.5

CVE-2023-6992 affecting package openjpeg2 2.3.1-12

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-43663
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-43807 5.5

CVE-2023-6992 affecting package teckit 2.5.9-4

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-43807
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVAZL-43870 5.5

CVE-2023-6992 affecting package clucene 2.3.3.4-38

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-43870
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-43957 5.5

CVE-2023-6992 affecting package fltk 1.3.5-4

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-43957
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-43969 5.5

CVE-2023-6992 affecting package ogdi 4.1.0-9

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-43969
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-44517 5.5

CVE-2023-6992 affecting package openjpeg2 2.3.1-12

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-44517
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVAZL-44754 5.5

CVE-2023-6992 affecting package fltk for versions less than 1.3.8-1

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-44754
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-44811 5.5

CVE-2023-6992 affecting package clucene 2.3.3.4-40

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-44811
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVAZL-45174 5.5

CVE-2023-6992 affecting package ogdi 4.1.1-3

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-45174
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVAZL-45198 5.5

CVE-2023-6992 affecting package teckit for versions less than 2.5.12-4

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
AZL-45198
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 4.0

Memory corruption issues is Cloudflare zlib implementation

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Record
CVE-2023-6992
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122, CWE-126, CWE-20
Updated
2026-11-02
OSVCLSA-2024-1716485905 No score

Fix CVE(s): CVE-2023-6992

  • SECURITY UPDATE: heap-based buffer overflow
    • debian/patches/CVE-2023-6992.patch: in deflace.c fix incorrectly calculated min size of block.
    • CVE-2023-6992
Record
CLSA-2024-1716485905
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openjpeg2
Azure Linux:2
 through 2.3.1-12 None known
teckit
Azure Linux:2
 through 2.5.9-4 None known
clucene
Azure Linux:2
 through 2.3.3.4-38 None known
fltk
Azure Linux:2
 through 1.3.5-4 None known
ogdi
Azure Linux:2
 through 4.1.0-9 None known
openjpeg2
Azure Linux:3
 through 2.3.1-12 None known
fltk
Azure Linux:3
 before 1.3.8-1
1.3.8-1
clucene
Azure Linux:3
 through 2.3.3.4-40 None known
ogdi
Azure Linux:3
 through 4.1.1-3 None known
teckit
Azure Linux:3
 before 2.5.12-4
2.5.12-4
Show 6 moreShow less
Affected packages
PackageAffectedFixed
lib32z1
TuxCare:Ubuntu:18.04
 before 1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
lib32z1-dev
TuxCare:Ubuntu:18.04
 before 1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
libx32z1
TuxCare:Ubuntu:18.04
 before 1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
libx32z1-dev
TuxCare:Ubuntu:18.04
 before 1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
zlib1g
TuxCare:Ubuntu:18.04
 before 1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
zlib1g-dev
TuxCare:Ubuntu:18.04
 before 1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2
1:1.2.11.dfsg-0ubuntu2.2+tuxcare.els2

History

History
RecordedChangedSources
factsOSV
affected
aliases, products, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-6992 is a medium vulnerability (CVSS 4.0) in Cloudflare Zlib, published January 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in fltk 1.3.8-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open