PT-2024-15165 · Cloudflare · Zlib

Martin Schwarzl + 1 · Published 2024-01-04 · Updated 2024-01-10 · CVE-2023-6992

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloudflare version of zlib library (affected versions not specified)

Description The Cloudflare version of the zlib library was found to have memory corruption issues due to improper input validation and heap-based buffer overflow in the deflation algorithm implementation. A local attacker could exploit this issue during compression using a crafted malicious file, potentially leading to denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Over-read

Memory Corruption

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-126

CWE-787

CWE-20

CWE-122

Related Identifiers

AZL-43663

AZL-43807

AZL-43870

AZL-43957

AZL-43969

AZL-44517

AZL-44754

AZL-44811

AZL-45174

AZL-45198

CVE-2023-6992

GHSA-VWW9-J87R-4CQH

Affected Products

Zlib

References · 19

• https://osv.dev/vulnerability/AZL-44754 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43957 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45174 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6992 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44517 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6992 · Security Note
• https://osv.dev/vulnerability/AZL-45198 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43663 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44811 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43807 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43870 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-6992 · Vendor Advisory
• https://github.com/cloudflare/zlib · Note
• https://github.com/cloudflare/zlib/security/advisories/GHSA-vww9-j87r-4cqh · Vendor Advisory, Patch