A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic.

Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITHSYSTEMZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.

zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition.

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

Great to see audits of widely used code! Gzip next?

Sam James <sam () gentoo org> writes: ZLB-01-001 WP2: Heap Buffer Overflow via Legacy gzprintf Implementation (High) That vulnerability seems to require that zlib was built with -DNOvsnprintf -DNOsnprintf, targetting a system lacking 'snprintf'.

Does anyone know of a real-world environment using that configuration?

I don't see the applicability discussed in the report, and before assigning a severity rating to this problem, I think it is relevant to understand what environments really are affected.

/Simon