CVE-2023-6992: Memory corruption issues is Cloudflare zlib implementation
Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.
Other sources
Memory corruption issues is Cloudflare zlib implementation
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6992?
CVE-2023-6992 is considered a high-severity vulnerability due to potential memory corruption issues.
How do I fix CVE-2023-6992?
To fix CVE-2023-6992, update your Cloudflare zlib library to a version later than 2023-11-16.
What systems are affected by CVE-2023-6992?
CVE-2023-6992 affects the Cloudflare version of the zlib library up to version 2023-11-16.
Can CVE-2023-6992 be exploited remotely?
CVE-2023-6992 is primarily exploitable by local attackers due to the nature of the vulnerability.
What are the consequences of exploiting CVE-2023-6992?
Exploiting CVE-2023-6992 could lead to memory corruption and could allow attackers to execute arbitrary code.