Skip to content

release-5.3: zlib: backport security fix for a reproducible crash in compressor

Andreas Gnau requested to merge agnau-release-5.3-cve-2018-25032 into release-5.3

Tavis has just reported, that he was recently trying to track down a reproducible crash in a compressor. Believe it or not, it really was a bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs.

Tavis has reported it upstream, but it turns out the issue has been public since 2018, but the patch never made it into a release. As far as he knows, nobody ever assigned it a CVE.

Runtime tested on ipq40xx/glinet-b1300 and mvebu/turris-omnia.

Suggested-by: Tavis Ormandy taviso@gmail.com References: https://www.openwall.com/lists/oss-security/2022/03/24/1 Signed-off-by: Petr Štetiar ynezz@true.cz (cherry picked from commit b3aa2909) (cherry picked from commit 3965dda0) (cherry picked from commit f65edc9b990c2bcc10c9e9fca29253adc6fe316d) (cherry picked from commit 0af411f49d43cb6e6cb00773abe63504392fb873) Fixes: CVE-2018-25032

Merge request reports