ZL
Vendor
zlib
18
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85091 | ZL zlib zlib | 7.4 | Sep 3 | zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate |
| CVE-2026-76844 | ZL zlib zlib | 7.4 | Aug 24 | zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write |
| CVE-2026-27171 | ZL zlib zlib | 5.5 | Feb 18 | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition |
| CVE-2026-22184 | ZL Zlib Zlib | 7.8 | Jan 7 | zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname() |
| CVE-2023-45853 | ZL Zlib Zlib | 9.8 | Oct 14 | MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field |
| CVE-2022-37434 | ZL Zlib Zlib | 9.8 | Aug 5 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field |
| CVE-2018-25032 | ZL Zlib Zlib | 7.5 | Mar 25 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches |
| CVE-2016-9843 | ZL Zlib Zlib | 9.8 | May 23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation |
| CVE-2016-9842 | ZL Zlib Zlib | 8.8 | May 23 | The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers |
| CVE-2016-9841 | ZL Zlib Zlib | 9.8 | May 23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic |
| CVE-2016-9840 | ZL Zlib Zlib | 8.8 | May 23 | inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic |
| CVE-2015-1191 | PI Pigz Zlib | – | Jan 21 | Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) |
| CVE-2013-0296 | PI Pigz Zlib | – | Apr 27 | Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file,… |
| CVE-2005-1849 | ZL Zlib Zlib | – | Jul 26 | inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced |
| CVE-2005-2096 | ZL Zlib Zlib | – | Jul 6 | zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater… |
| CVE-2004-0797 | ZL Zlib Zlib | – | Oct 20 | The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash) |
| CVE-2003-0107 | ZL Zlib Zlib | – | Mar 7 | Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a… |
| CVE-2002-0059 | ZL Zlib Zlib | 9.8 | Mar 15 | The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double… |