Every CVE Search/ Get API key

CVE-2022-37434

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c...

9.8 CriticalPublic exploitFix available

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

19.2%Up 18.3 points since Aug 5, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
CVE-2022-37434
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787, CWE-120
Updated
2026-11-02
CVE List 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
CVE-2022-37434
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2022-40062 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
EUVD-2022-40062
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-cfmr-vrgj-vqwv 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c...

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
GHSA-cfmr-vrgj-vqwv
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2022-37434 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
ALPINE-CVE-2022-37434
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-10470 9.8

CVE-2022-37434 affecting package zlib for versions less than 1.2.12-2

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-10470
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 46 moreShow less
OSVAZL-41380 9.8

CVE-2022-37434 affecting package crash for versions less than 8.0.4-2

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-41380
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-42760 9.8

CVE-2022-37434 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-42760
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-43906 9.8

CVE-2022-37434 affecting package ogdi 4.1.0-9

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-43906
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-44121 9.8

CVE-2022-37434 affecting package gdal 3.6.3-2

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-44121
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-44136 9.8

CVE-2022-37434 affecting package ogdi 4.1.1-3

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-44136
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-44268 9.8

CVE-2022-37434 affecting package openjpeg2 2.3.1-12

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-44268
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-44358 9.8

CVE-2022-37434 affecting package deltarpm 3.6.5-2

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-44358
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-44769 9.8

CVE-2022-37434 affecting package teckit for versions less than 2.5.12-4

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-44769
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-44991 9.8

CVE-2022-37434 affecting package fltk 1.3.8-1

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-44991
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-45096 9.8

CVE-2022-37434 affecting package clucene 2.3.3.4-40

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-45096
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-45276 9.8

CVE-2022-37434 affecting package gpsbabel 1.8.0-4

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
AZL-45276
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVBELL-CVE-2022-37434 9.8

CVE-2022-37434 does not affect BellSoft software

Record
BELL-CVE-2022-37434
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
CVE-2022-37434
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVJLSEC-2026-478 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
JLSEC-2026-478
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1843 9.8

zlib security update

Zlib is a free, general-purpose, not covered by any patents, lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms.

Security Fix(es):

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).(CVE-2022-37434)

Record
OESA-2022-1843
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1853 9.8

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).(CVE-2022-37434)

Record
OESA-2022-1853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1892 9.8

sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done.

Security Fix(es):

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).(CVE-2022-37434)

Record
OESA-2022-1892
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1973 9.8

deltarpm security update

Delta RPM packages contain the difference between an old and a new version of an RPM package. Applying a delta RPM on an old RPM results in the complete new RPM. It is not necessary to have a copy of the old RPM, because a delta RPM can also work with an installed RPM.

Security Fix(es):

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).(CVE-2022-37434)

Record
OESA-2022-1973
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-2003 9.8

mariadb-connector-c security update

This package is used for connecting C/C++ programs to MariaDB and MySQL database.

Security Fix(es):

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).(CVE-2022-37434)

Record
OESA-2022-2003
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2023-1285 9.8

mysql security update

The MySQL(TM) software delivers a very fast, multi-threaded, multi-user,and robust SQL (Structured Query Language) database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or its affiliates The MySQL software has Dual Licensing, which means you can use the MySQL software free of charge under the GNU General Public License (http://www.gnu.org/licenses/). You can also purchase commercial MySQL licenses from Oracle and/or its affiliates if you do not wish to be bound by the terms of the GPL. See the chapter "Licensing and Support" in the manual for further info.

Security Fix(es):

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).(CVE-2022-37434)

Record
OESA-2023-1285
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7106 7.0

Red Hat Security Advisory: zlib security update

Record
RHSA-2022:7106
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2022:7314 7.0

Red Hat Security Advisory: zlib security update

Record
RHSA-2022:7314
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2022:7793 7.0

Red Hat Security Advisory: rsync security and enhancement update

Record
RHSA-2022:7793
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2022:8291 7.0

Red Hat Security Advisory: rsync security and bug fix update

Record
RHSA-2022:8291
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:1095 7.0

Red Hat Security Advisory: zlib security update

Record
RHSA-2023:1095
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2024:0254 7.0

Red Hat Security Advisory: rsync security update

Record
RHSA-2024:0254
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2022:7106 7.0

Moderate: zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.

Security Fix(es):

  • zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:7106
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2022:7314 7.0

Moderate: zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.

Security Fix(es):

  • zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:7314
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2022:7793 7.0

Moderate: rsync security and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Record
RLSA-2022:7793
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2022:8291 7.0

Moderate: rsync security and bug fix update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Record
RLSA-2022:8291
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-37434 9.8

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
UBUNTU-CVE-2022-37434
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:7106 No score

Moderate: zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.

Security Fix(es):

  • zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:7106
Updated
2026-11-02
OSVALSA-2022:7314 No score

Moderate: zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.

Security Fix(es):

  • zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:7314
Updated
2026-11-02
OSVALSA-2022:7793 No score

Moderate: rsync security and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:7793
Updated
2026-11-02
OSVALSA-2022:8291 No score

Moderate: rsync security and bug fix update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field (CVE-2022-37434)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:8291
Updated
2026-11-02
OSVCLSA-2022-1660757579 No score

Fixed CVE-2022-37434 in zlib

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1660757579
Updated
2026-11-02
OSVCLSA-2022-1660758906 No score

Fixed CVE-2022-37434 in zlib

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1660758906
Updated
2026-11-02
OSVCLSA-2022-1660759457 No score

Fixed CVE-2022-37434 in zlib

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1660759457
Updated
2026-11-02
OSVCLSA-2022-1660760405 No score

Fix CVE(s): CVE-2022-37434

  • SECURITY UPDATE: possible buffer overflow when getting a gzip header extra field with inflate()
    • debian/patches/CVE-2022-37434.patch: ensure that space the user provided with inflateGetHeader() is enough when multiple calls of inflate() delivers an extra header data.
    • CVE-2022-37434
Record
CLSA-2022-1660760405
Updated
2026-11-02
OSVCLSA-2022-1660762053 No score

Fixed CVE-2022-37434 in zlib

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1660762053
Updated
2026-11-02
OSVCLSA-2022-1661442133 No score

Fixed CVE-2022-37434 in rsync

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1661442133
Updated
2026-11-02
OSVCLSA-2022-1661442999 No score

Fixed CVE-2022-37434 in rsync

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1661442999
Updated
2026-11-02
OSVCLSA-2022-1661443683 No score

Fixed CVE-2022-37434 in rsync

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1661443683
Updated
2026-11-02
OSVCLSA-2022-1661443990 No score

Fixed CVE-2022-37434 in rsync

  • CVE-2022-37434: fix possible buffer overflow when getting a gzip header extra field with inflate()
Record
CLSA-2022-1661443990
Updated
2026-11-02
OSVCLSA-2023-1699380056 No score

rsync: Fix of 2 CVEs

  • CVE-2018-25032: fix a bug that can crash deflate on some input when using Z_FIXED
  • CVE-2022-37434: fix zlib bug with a large gzip header extra field
Record
CLSA-2023-1699380056
Updated
2026-11-02
OSVDEBIAN-CVE-2022-37434 No score

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Record
DEBIAN-CVE-2022-37434
Updated
2026-11-03

Affected products

Show 20 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
zlib
Alpine:v3.11
 before 1.2.11-r4
1.2.11-r4
zlib
Alpine:v3.12
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.13
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.14
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.15
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.16
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.17
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.18
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.19
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.20
 before 1.2.12-r2
1.2.12-r2
Show 217 moreShow less
Affected packages
PackageAffectedFixed
zlib
Alpine:v3.21
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.22
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.23
 before 1.2.12-r2
1.2.12-r2
zlib
Alpine:v3.24
 before 1.2.12-r2
1.2.12-r2
zlib-ng
Alpine:v3.17
 before 2.0.6-r0
2.0.6-r0
zlib-ng
Alpine:v3.18
 before 2.0.6-r0
2.0.6-r0
zlib-ng
Alpine:v3.19
 before 2.0.6-r0
2.0.6-r0
zlib-ng
Alpine:v3.20
 before 2.0.6-r0
2.0.6-r0
zlib-ng
Alpine:v3.21
 before 2.0.6-r0
2.0.6-r0
zlib-ng
Alpine:v3.22
 before 2.0.6-r0
2.0.6-r0
zlib-ng
Alpine:v3.23
 before 2.0.6-r0
2.0.6-r0
zlib-ng
Alpine:v3.24
 before 2.0.6-r0
2.0.6-r0
zlib
AlmaLinux:8
 before 1.2.11-19.el8_6
1.2.11-19.el8_6
zlib-devel
AlmaLinux:8
 before 1.2.11-19.el8_6
1.2.11-19.el8_6
zlib-static
AlmaLinux:8
 before 1.2.11-19.el8_6
1.2.11-19.el8_6
zlib
AlmaLinux:9
 before 1.2.11-32.el9_0
1.2.11-32.el9_0
zlib-devel
AlmaLinux:9
 before 1.2.11-32.el9_0
1.2.11-32.el9_0
zlib-static
AlmaLinux:9
 before 1.2.11-32.el9_0
1.2.11-32.el9_0
rsync
AlmaLinux:8
 before 3.1.3-19.el8
3.1.3-19.el8
rsync-daemon
AlmaLinux:8
 before 3.1.3-19.el8
3.1.3-19.el8
rsync
AlmaLinux:9
 before 3.2.3-18.el9
3.2.3-18.el9
rsync-daemon
AlmaLinux:9
 before 3.2.3-18.el9
3.2.3-18.el9
zlib
Azure Linux:2
 before 1.2.12-2
1.2.12-2
crash
Azure Linux:3
 before 8.0.4-2
8.0.4-2
cloud-hypervisor-cvm
Azure Linux:3
 before 38.0.72.2-1
38.0.72.2-1
ogdi
Azure Linux:2
 through 4.1.0-9 None known
gdal
Azure Linux:3
 through 3.6.3-2 None known
ogdi
Azure Linux:3
 through 4.1.1-3 None known
openjpeg2
Azure Linux:3
 through 2.3.1-12 None known
deltarpm
Azure Linux:3
 through 3.6.5-2 None known
teckit
Azure Linux:3
 before 2.5.12-4
2.5.12-4
fltk
Azure Linux:3
 through 1.3.8-1 None known
clucene
Azure Linux:3
 through 2.3.3.4-40 None known
gpsbabel
Azure Linux:3
 through 1.8.0-4 None known
zlib
TuxCare:CentOS:8.4
 before 1.2.11-17.el8.tuxcare.els2
1.2.11-17.el8.tuxcare.els2
zlib-devel
TuxCare:CentOS:8.4
 before 1.2.11-17.el8.tuxcare.els2
1.2.11-17.el8.tuxcare.els2
zlib-static
TuxCare:CentOS:8.4
 before 1.2.11-17.el8.tuxcare.els2
1.2.11-17.el8.tuxcare.els2
zlib
TuxCare:CentOS:8.5
 before 1.2.11-17.el8.tuxcare.els2
1.2.11-17.el8.tuxcare.els2
zlib-devel
TuxCare:CentOS:8.5
 before 1.2.11-17.el8.tuxcare.els2
1.2.11-17.el8.tuxcare.els2
zlib-static
TuxCare:CentOS:8.5
 before 1.2.11-17.el8.tuxcare.els2
1.2.11-17.el8.tuxcare.els2
minizip
TuxCare:OracleLinux:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
minizip-devel
TuxCare:OracleLinux:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
zlib
TuxCare:OracleLinux:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
zlib-devel
TuxCare:OracleLinux:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
zlib-static
TuxCare:OracleLinux:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
lib32z1
TuxCare:Ubuntu:16.04
 before 1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
lib32z1-dev
TuxCare:Ubuntu:16.04
 before 1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
libx32z1
TuxCare:Ubuntu:16.04
 before 1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
libx32z1-dev
TuxCare:Ubuntu:16.04
 before 1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
zlib1g
TuxCare:Ubuntu:16.04
 before 1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
zlib1g-dev
TuxCare:Ubuntu:16.04
 before 1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
1:1.2.8.dfsg-2ubuntu4.3+tuxcare.els2
minizip
TuxCare:CentOS:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
minizip-devel
TuxCare:CentOS:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
zlib
TuxCare:CentOS:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
zlib-devel
TuxCare:CentOS:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
zlib-static
TuxCare:CentOS:6
 before 1.2.3-29.el6.tuxcare.els2
1.2.3-29.el6.tuxcare.els2
rsync
TuxCare:OracleLinux:6
 before 3.0.6-12.el6.tuxcare.els3
3.0.6-12.el6.tuxcare.els3
rsync
TuxCare:CentOS:6
 before 3.0.6-12.el6.tuxcare.els3
3.0.6-12.el6.tuxcare.els3
rsync
TuxCare:CentOS:8.5
 before 3.1.3-12.el8.tuxcare.els3
3.1.3-12.el8.tuxcare.els3
rsync-daemon
TuxCare:CentOS:8.5
 before 3.1.3-12.el8.tuxcare.els3
3.1.3-12.el8.tuxcare.els3
rsync
TuxCare:CentOS:8.4
 before 3.1.3-12.el8.tuxcare.els3
3.1.3-12.el8.tuxcare.els3
rsync-daemon
TuxCare:CentOS:8.4
 before 3.1.3-12.el8.tuxcare.els3
3.1.3-12.el8.tuxcare.els3
rsync
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 3.1.2-12.el7_9.tuxcare.els1
3.1.2-12.el7_9.tuxcare.els1
libz-mingw-w64
Debian:12
 before 1.2.12+dfsg-2
1.2.12+dfsg-2
libz-mingw-w64
Debian:13
 before 1.2.12+dfsg-2
1.2.12+dfsg-2
libz-mingw-w64
Debian:14
 before 1.2.12+dfsg-2
1.2.12+dfsg-2
zlib
Debian:12
 before 1:1.2.11.dfsg-4.1
1:1.2.11.dfsg-4.1
zlib
Debian:13
 before 1:1.2.11.dfsg-4.1
1:1.2.11.dfsg-4.1
zlib
Debian:14
 before 1:1.2.11.dfsg-4.1
1:1.2.11.dfsg-4.1
zlib
Debian:10
 before 1:1.2.11.dfsg-1+deb10u2, plus listed versions
1:1.2.11.dfsg-11:1.2.11.dfsg-1+deb10u1
1:1.2.11.dfsg-1+deb10u2
zlib
Debian:11
 before 1:1.2.11.dfsg-2+deb11u2, plus listed versions
1:1.2.11.dfsg-21:1.2.11.dfsg-2+deb11u1
1:1.2.11.dfsg-2+deb11u2
GCCBootstrap_jll
Julia
 All versions None known
Openresty_jll
Julia
 before 1.27.1+0
1.27.1+0
Zlib_jll
Julia
 before 1.2.13+0
1.2.13+0
zlib
Mageia:8
 before 1.2.12-1.3.mga8
1.2.12-1.3.mga8
zlib
openEuler:20.03-LTS-SP1
 before 1.2.11-20.oe1
1.2.11-20.oe1
zlib
openEuler:20.03-LTS-SP3
 before 1.2.11-21.oe1
1.2.11-21.oe1
zlib
openEuler:22.03-LTS
 before 1.2.11-22.oe2203
1.2.11-22.oe2203
rsync
openEuler:20.03-LTS-SP1
 before 3.1.3-8.oe1
3.1.3-8.oe1
rsync
openEuler:20.03-LTS-SP3
 before 3.1.3-8.oe1
3.1.3-8.oe1
rsync
openEuler:22.03-LTS
 before 3.2.3-3.oe2203
3.2.3-3.oe2203
sudo
openEuler:20.03-LTS-SP1
 before 1.9.2-6.oe1
1.9.2-6.oe1
sudo
openEuler:20.03-LTS-SP3
 before 1.9.2-6.oe1
1.9.2-6.oe1
sudo
openEuler:22.03-LTS
 before 1.9.8p2-3.oe2203
1.9.8p2-3.oe2203
deltarpm
openEuler:20.03-LTS-SP1
 before 3.6.2-5.oe1
3.6.2-5.oe1
deltarpm
openEuler:20.03-LTS-SP3
 before 3.6.2-5.oe1
3.6.2-5.oe1
deltarpm
openEuler:22.03-LTS
 before 3.6.3-2.oe2203
3.6.3-2.oe2203
mariadb-connector-c
openEuler:20.03-LTS-SP1
 before 3.0.6-8.oe1
3.0.6-8.oe1
mariadb-connector-c
openEuler:20.03-LTS-SP3
 before 3.0.6-9.oe1
3.0.6-9.oe1
mariadb-connector-c
openEuler:22.03-LTS
 before 3.1.13-2.oe2203
3.1.13-2.oe2203
mysql
openEuler:20.03-LTS-SP1
 before 8.0.28-2.oe1
8.0.28-2.oe1
mysql
openEuler:20.03-LTS-SP3
 before 8.0.28-2.oe1
8.0.28-2.oe1
mysql
openEuler:22.03-LTS
 before 8.0.29-2.oe2203sp1
8.0.29-2.oe2203sp1
mysql
openEuler:22.03-LTS-SP1
 before 8.0.29-2.oe2203sp1
8.0.29-2.oe2203sp1
zlib
Red Hat:enterprise_linux:8::baseos
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
zlib-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
zlib-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
zlib-devel
Red Hat:enterprise_linux:8::baseos
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
zlib-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
zlib-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
zlib-static
Red Hat:enterprise_linux:8::crb
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
minizip-compat-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-devel
Red Hat:enterprise_linux:9::appstream
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
minizip-compat-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib
Red Hat:enterprise_linux:9::baseos
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
minizip-compat-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
zlib-static
Red Hat:enterprise_linux:9::crb
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
rsync
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-19.el8
0:3.1.3-19.el8
rsync-daemon
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-19.el8
0:3.1.3-19.el8
rsync-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-19.el8
0:3.1.3-19.el8
rsync-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-19.el8
0:3.1.3-19.el8
rsync-daemon
Red Hat:enterprise_linux:9::appstream
 before 0:3.2.3-18.el9
0:3.2.3-18.el9
rsync
Red Hat:enterprise_linux:9::baseos
 before 0:3.2.3-18.el9
0:3.2.3-18.el9
rsync-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:3.2.3-18.el9
0:3.2.3-18.el9
rsync-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:3.2.3-18.el9
0:3.2.3-18.el9
zlib
Red Hat:enterprise_linux:7::client
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip
Red Hat:enterprise_linux:7::client
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip-devel
Red Hat:enterprise_linux:7::client
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-devel
Red Hat:enterprise_linux:7::client
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-static
Red Hat:enterprise_linux:7::client
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-static
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib
Red Hat:enterprise_linux:7::server
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-devel
Red Hat:enterprise_linux:7::server
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip
Red Hat:enterprise_linux:7::server
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip-devel
Red Hat:enterprise_linux:7::server
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-static
Red Hat:enterprise_linux:7::server
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
minizip-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
zlib-static
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.7-21.el7_9
0:1.2.7-21.el7_9
rsync
Red Hat:rhel_eus:8.6::baseos
 before 0:3.1.3-14.el8_6.5
0:3.1.3-14.el8_6.5
rsync-daemon
Red Hat:rhel_eus:8.6::baseos
 before 0:3.1.3-14.el8_6.5
0:3.1.3-14.el8_6.5
rsync-debuginfo
Red Hat:rhel_eus:8.6::baseos
 before 0:3.1.3-14.el8_6.5
0:3.1.3-14.el8_6.5
rsync-debugsource
Red Hat:rhel_eus:8.6::baseos
 before 0:3.1.3-14.el8_6.5
0:3.1.3-14.el8_6.5
zlib
Rocky Linux:8
 before 0:1.2.11-19.el8_6
0:1.2.11-19.el8_6
zlib
Rocky Linux:9
 before 0:1.2.11-32.el9_0
0:1.2.11-32.el9_0
rsync
Rocky Linux:8
 before 0:3.1.3-19.el8
0:3.1.3-19.el8
rsync
Rocky Linux:9
 before 0:3.2.3-18.el9
0:3.2.3-18.el9
zlib
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.2.8-12.9.1
1.2.8-12.9.1
zlib
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.2.8-12.9.1
1.2.8-12.9.1
zlib
SUSE:OpenStack Cloud 9
 before 1.2.11-3.9.1
1.2.11-3.9.1
zlib
SUSE:OpenStack Cloud Crowbar 9
 before 1.2.11-3.9.1
1.2.11-3.9.1
zlib
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.2.11-3.9.1
1.2.11-3.9.1
zlib
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.2.11-3.9.1
1.2.11-3.9.1
zlib
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.2.11-11.22.1
1.2.11-11.22.1
zlib
SUSE:Linux Enterprise Server 12 SP5
 before 1.2.11-11.22.1
1.2.11-11.22.1
zlib
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.2.11-11.22.1
1.2.11-11.22.1
zlib
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Module for Development Tools 15 SP3
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Module for Development Tools 15 SP4
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server 15-LTSS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Manager Proxy 4.1
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Manager Retail Branch Server 4.1
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Manager Server 4.1
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Micro 5.1
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Linux Enterprise Micro 5.2
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Enterprise Storage 6
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
SUSE:Enterprise Storage 7
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
openSUSE:Leap 15.3
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
zlib
openSUSE:Leap 15.4
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
klibc
Ubuntu:Pro:14.04:LTS
 before 2.0.3-0ubuntu1.14.04.3+esm3, plus listed versions
2.0.1-3.1ubuntu22.0.2-1ubuntu12.0.2-1ubuntu22.0.3-0ubuntu12.0.3-0ubuntu1.14.04.12.0.3-0ubuntu1.14.04.22.0.3-0ubuntu1.14.04.32.0.3-0ubuntu1.14.04.3+esm2
2.0.3-0ubuntu1.14.04.3+esm3
zlib
Ubuntu:Pro:14.04:LTS
 before 1:1.2.8.dfsg-1ubuntu1.1+esm2, plus listed versions
1:1.2.8.dfsg-1ubuntu11:1.2.8.dfsg-1ubuntu1.11:1.2.8.dfsg-1ubuntu1.1+esm1
1:1.2.8.dfsg-1ubuntu1.1+esm2
klibc
Ubuntu:Pro:16.04:LTS
 before 2.0.4-8ubuntu1.16.04.4+esm2, plus listed versions
2.0.3-0ubuntu12.0.4-42.0.4-62.0.4-72.0.4-8
Show 6 moreShow less
2.0.4-8ubuntu12.0.4-8ubuntu1.16.04.12.0.4-8ubuntu1.16.04.22.0.4-8ubuntu1.16.04.32.0.4-8ubuntu1.16.04.42.0.4-8ubuntu1.16.04.4+esm1
2.0.4-8ubuntu1.16.04.4+esm2
rsync
Ubuntu:Pro:16.04:LTS
 before 3.1.1-3ubuntu1.3+esm2, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.33.1.1-3ubuntu1.3+esm1
3.1.1-3ubuntu1.3+esm2
zlib
Ubuntu:Pro:16.04:LTS
 before 1:1.2.8.dfsg-2ubuntu4.3+esm2, plus listed versions
1:1.2.8.dfsg-2ubuntu41:1.2.8.dfsg-2ubuntu4.11:1.2.8.dfsg-2ubuntu4.31:1.2.8.dfsg-2ubuntu4.3+esm1
1:1.2.8.dfsg-2ubuntu4.3+esm2
rsync
Ubuntu:18.04:LTS
 before 3.1.2-2.1ubuntu1.5, plus listed versions
3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.23.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.4
3.1.2-2.1ubuntu1.5
zlib
Ubuntu:18.04:LTS
 before 1:1.2.11.dfsg-0ubuntu2.2, plus listed versions
1:1.2.11.dfsg-0ubuntu21:1.2.11.dfsg-0ubuntu2.1
1:1.2.11.dfsg-0ubuntu2.2
klibc
Ubuntu:Pro:18.04:LTS
 before 2.0.4-9ubuntu2.2+esm1, plus listed versions
2.0.4-9ubuntu12.0.4-9ubuntu22.0.4-9ubuntu2.12.0.4-9ubuntu2.2
2.0.4-9ubuntu2.2+esm1
klibc
Ubuntu:20.04:LTS
 before 2.0.7-1ubuntu5.2, plus listed versions
2.0.6-1ubuntu12.0.6-1ubuntu22.0.7-1ubuntu12.0.7-1ubuntu32.0.7-1ubuntu42.0.7-1ubuntu52.0.7-1ubuntu5.1
2.0.7-1ubuntu5.2
rsync
Ubuntu:20.04:LTS
 before 3.1.3-8ubuntu0.4, plus listed versions
3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3
3.1.3-8ubuntu0.4
zlib
Ubuntu:20.04:LTS
 before 1:1.2.11.dfsg-2ubuntu1.5, plus listed versions
1:1.2.11.dfsg-1ubuntu31:1.2.11.dfsg-2ubuntu11:1.2.11.dfsg-2ubuntu1.11:1.2.11.dfsg-2ubuntu1.21:1.2.11.dfsg-2ubuntu1.31:1.2.11.dfsg-2ubuntu1.4
1:1.2.11.dfsg-2ubuntu1.5
klibc
Ubuntu:22.04:LTS
 before 2.0.10-4ubuntu0.1, plus listed versions
2.0.8-6.1ubuntu22.0.10-32.0.10-4
2.0.10-4ubuntu0.1
zlib
Ubuntu:22.04:LTS
 before 1:1.2.11.dfsg-2ubuntu9.2, plus listed versions
1:1.2.11.dfsg-2ubuntu71:1.2.11.dfsg-2ubuntu91:1.2.11.dfsg-2ubuntu9.1
1:1.2.11.dfsg-2ubuntu9.2
klibc
Ubuntu:24.04:LTS
 before 2.0.13-4ubuntu0.1, plus listed versions
2.0.13-12.0.13-22.0.13-2ubuntu12.0.13-4
2.0.13-4ubuntu0.1
klibc
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 2.0.3-0ubuntu1.14.04.3+esm3, plus listed versions
2.0.1-3.1ubuntu22.0.2-1ubuntu12.0.2-1ubuntu22.0.3-0ubuntu12.0.3-0ubuntu1.14.04.12.0.3-0ubuntu1.14.04.22.0.3-0ubuntu1.14.04.32.0.3-0ubuntu1.14.04.3+esm2
2.0.3-0ubuntu1.14.04.3+esm3
klibc
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 2.0.4-8ubuntu1.16.04.4+esm2, plus listed versions
2.0.3-0ubuntu12.0.4-42.0.4-62.0.4-72.0.4-8
Show 6 moreShow less
2.0.4-8ubuntu12.0.4-8ubuntu1.16.04.12.0.4-8ubuntu1.16.04.22.0.4-8ubuntu1.16.04.32.0.4-8ubuntu1.16.04.42.0.4-8ubuntu1.16.04.4+esm1
2.0.4-8ubuntu1.16.04.4+esm2
klibc
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 2.0.4-9ubuntu2.2+esm1, plus listed versions
2.0.4-9ubuntu12.0.4-9ubuntu22.0.4-9ubuntu2.12.0.4-9ubuntu2.2
2.0.4-9ubuntu2.2+esm1
klibc
Ubuntu:20.04:LTS
From an advisory covering 4 CVEs
 before 2.0.7-1ubuntu5.2, plus listed versions
2.0.6-1ubuntu12.0.6-1ubuntu22.0.7-1ubuntu12.0.7-1ubuntu32.0.7-1ubuntu42.0.7-1ubuntu52.0.7-1ubuntu5.1
2.0.7-1ubuntu5.2
klibc
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 2.0.10-4ubuntu0.1, plus listed versions
2.0.8-6.1ubuntu22.0.10-32.0.10-4
2.0.10-4ubuntu0.1
klibc
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 2.0.13-4ubuntu0.1, plus listed versions
2.0.13-12.0.13-22.0.13-2ubuntu12.0.13-4
2.0.13-4ubuntu0.1
zlib
openSUSE:Leap Micro 5.2
 before 1.2.11-150000.3.33.1
1.2.11-150000.3.33.1
vlc
SUSE:Package Hub 15 SP4
From an advisory covering 2 CVEs
 before 3.0.20-bp154.2.6.1
3.0.20-bp154.2.6.1
vlc
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 3.0.20-bp154.2.6.1
3.0.20-bp154.2.6.1
vlc
SUSE:Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 3.0.20-bp155.2.3.1
3.0.20-bp155.2.3.1
vlc
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 3.0.20-bp155.2.3.1
3.0.20-bp155.2.3.1
rsync
openSUSE:Tumbleweed
 before 3.2.5-1.1
3.2.5-1.1
libqt5-qtbase
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 5.15.6+kde177-1.1
5.15.6+kde177-1.1
vlc
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.0.19-1.1
3.0.19-1.1
rusty_v8
openSUSE:Tumbleweed
 before 0.106.0-1.1
0.106.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubxen0bit/CVE-2022-37434_poc2022-10-15
PoC in GitHubTrinadh465/external_zlib_CVE-2022-374342024-02-02

History

History
RecordedChangedSources
affectedOSV
factsOSV
affectedOSV
exploitsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-37434 is a critical vulnerability (CVSS 9.8) in Zlib, published August 5, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.2%, the 97th percentile. Fixed in zlib 1.2.11-r4.

References

Show 110 moreShow less
This page doesn't list everything

Left out on purpose, here and in the API, to keep responses small: 19 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open