PT-2016-3192 · Zlib+5 · Zlib+5
Published
2016-09-22
·
Updated
2024-08-28
·
CVE-2016-9842
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
zlib versions 1.2.8
Description
The issue is related to an error in handling negative numbers in the inflateMark function of the zlib library. This could allow a remote attacker to cause unspecified impact, potentially leading to disruption of confidentiality, integrity, and availability of protected information. The vulnerability might be exploited by vectors involving left shifts of negative integers, and it could also lead to a denial of service via a big-endian out-of-bounds pointer.
Recommendations
For zlib version 1.2.8, consider disabling the inflateMark function as a temporary workaround until a patch is available. Restrict access to the zlib library to minimize the risk of exploitation. Avoid using the zlib library to process specially crafted documents until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ibm Aix
Red Hat
Suse
Ubuntu
Zlib