Skip to content

release-6.4: zlib: backport security fix for a reproducible crash in compressor

Andreas Gnau requested to merge agnau-release-6.4-cve-2018-25032 into release-6.4

Tavis has just reported, that he was recently trying to track down a reproducible crash in a compressor. Believe it or not, it really was a bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs.

Tavis has reported it upstream, but it turns out the issue has been public since 2018, but the patch never made it into a release. As far as he knows, nobody ever assigned it a CVE.

Suggested-by: Tavis Ormandy taviso@gmail.com References: https://www.openwall.com/lists/oss-security/2022/03/24/1 Signed-off-by: Petr Štetiar ynezz@true.cz (cherry picked from commit b3aa2909) (cherry picked from commit 3965dda0) (cherry picked from commit f65edc9b990c2bcc10c9e9fca29253adc6fe316d) Fixes: CVE-2018-25032

Merge request reports