The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• nodejs node.js4.0.0 and later · up to 4.1.2 inclusive
• nodejs node.js7.0.0 and later · before 7.6.0
• nodejs node.js6.9.0 and later · before 6.10.2
• nodejs node.js6.0.0 and later · up to 6.8.1 inclusive
• nodejs node.js4.2.0 and later · before 4.8.2
• oracle jdk1.6.0
• oracle jdk1.7.0
• oracle jdk1.8.0
• oracle jre1.6.0
• oracle jre1.7.0
• oracle jre1.8.0
• oracle mysql5.5.0 and later · up to 5.5.61 inclusive
• oracle mysql8.0.0 and later · up to 8.0.12 inclusive
• oracle mysql5.7.0 and later · up to 5.7.23 inclusive
• oracle mysql5.6.0 and later · up to 5.6.41 inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2018-25032zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
  46Plan
• CVE-2022-37434zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.
  45Plan
• CVE-2002-0059The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certai
  42Plan
• CVE-2016-9841inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
  41Plan
• CVE-2023-45853MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,
  40Plan
• CVE-2003-0107Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnp
  38Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.