zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition.

Great to see audits of widely used code! Gzip next?

Sam James <sam () gentoo org> writes: ZLB-01-001 WP2: Heap Buffer Overflow via Legacy gzprintf Implementation (High) That vulnerability seems to require that zlib was built with -DNOvsnprintf -DNOsnprintf, targetting a system lacking 'snprintf'.

Does anyone know of a real-world environment using that configuration?

I don't see the applicability discussed in the report, and before assigning a severity rating to this problem, I think it is relevant to understand what environments really are affected.

/Simon

A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic.

Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITHSYSTEMZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.