Headline
Red Hat Security Advisory 2023-1095-01
Red Hat Security Advisory 2023-1095-01 - The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Issues addressed include a buffer over-read vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: zlib security update
Advisory ID: RHSA-2023:1095-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1095
Issue date: 2023-03-07
CVE Names: CVE-2022-37434
====================================================================
- Summary:
An update for zlib is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
- Description:
The zlib packages provide a general-purpose lossless data compression
library that is used by many different programs.
Security Fix(es):
- zlib: heap-based buffer over-read and overflow in inflate() in inflate.c
via a large gzip header extra field (CVE-2022-37434)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2116639 - CVE-2022-37434 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
zlib-1.2.7-21.el7_9.src.rpm
x86_64:
zlib-1.2.7-21.el7_9.i686.rpm
zlib-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
minizip-1.2.7-21.el7_9.i686.rpm
minizip-1.2.7-21.el7_9.x86_64.rpm
minizip-devel-1.2.7-21.el7_9.i686.rpm
minizip-devel-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
zlib-devel-1.2.7-21.el7_9.i686.rpm
zlib-devel-1.2.7-21.el7_9.x86_64.rpm
zlib-static-1.2.7-21.el7_9.i686.rpm
zlib-static-1.2.7-21.el7_9.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
zlib-1.2.7-21.el7_9.src.rpm
x86_64:
zlib-1.2.7-21.el7_9.i686.rpm
zlib-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64:
minizip-1.2.7-21.el7_9.i686.rpm
minizip-1.2.7-21.el7_9.x86_64.rpm
minizip-devel-1.2.7-21.el7_9.i686.rpm
minizip-devel-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
zlib-devel-1.2.7-21.el7_9.i686.rpm
zlib-devel-1.2.7-21.el7_9.x86_64.rpm
zlib-static-1.2.7-21.el7_9.i686.rpm
zlib-static-1.2.7-21.el7_9.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
zlib-1.2.7-21.el7_9.src.rpm
ppc64:
zlib-1.2.7-21.el7_9.ppc.rpm
zlib-1.2.7-21.el7_9.ppc64.rpm
zlib-debuginfo-1.2.7-21.el7_9.ppc.rpm
zlib-debuginfo-1.2.7-21.el7_9.ppc64.rpm
zlib-devel-1.2.7-21.el7_9.ppc.rpm
zlib-devel-1.2.7-21.el7_9.ppc64.rpm
ppc64le:
zlib-1.2.7-21.el7_9.ppc64le.rpm
zlib-debuginfo-1.2.7-21.el7_9.ppc64le.rpm
zlib-devel-1.2.7-21.el7_9.ppc64le.rpm
s390x:
zlib-1.2.7-21.el7_9.s390.rpm
zlib-1.2.7-21.el7_9.s390x.rpm
zlib-debuginfo-1.2.7-21.el7_9.s390.rpm
zlib-debuginfo-1.2.7-21.el7_9.s390x.rpm
zlib-devel-1.2.7-21.el7_9.s390.rpm
zlib-devel-1.2.7-21.el7_9.s390x.rpm
x86_64:
zlib-1.2.7-21.el7_9.i686.rpm
zlib-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
zlib-devel-1.2.7-21.el7_9.i686.rpm
zlib-devel-1.2.7-21.el7_9.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
minizip-1.2.7-21.el7_9.ppc.rpm
minizip-1.2.7-21.el7_9.ppc64.rpm
minizip-devel-1.2.7-21.el7_9.ppc.rpm
minizip-devel-1.2.7-21.el7_9.ppc64.rpm
zlib-debuginfo-1.2.7-21.el7_9.ppc.rpm
zlib-debuginfo-1.2.7-21.el7_9.ppc64.rpm
zlib-static-1.2.7-21.el7_9.ppc.rpm
zlib-static-1.2.7-21.el7_9.ppc64.rpm
ppc64le:
minizip-1.2.7-21.el7_9.ppc64le.rpm
minizip-devel-1.2.7-21.el7_9.ppc64le.rpm
zlib-debuginfo-1.2.7-21.el7_9.ppc64le.rpm
zlib-static-1.2.7-21.el7_9.ppc64le.rpm
s390x:
minizip-1.2.7-21.el7_9.s390.rpm
minizip-1.2.7-21.el7_9.s390x.rpm
minizip-devel-1.2.7-21.el7_9.s390.rpm
minizip-devel-1.2.7-21.el7_9.s390x.rpm
zlib-debuginfo-1.2.7-21.el7_9.s390.rpm
zlib-debuginfo-1.2.7-21.el7_9.s390x.rpm
zlib-static-1.2.7-21.el7_9.s390.rpm
zlib-static-1.2.7-21.el7_9.s390x.rpm
x86_64:
minizip-1.2.7-21.el7_9.i686.rpm
minizip-1.2.7-21.el7_9.x86_64.rpm
minizip-devel-1.2.7-21.el7_9.i686.rpm
minizip-devel-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
zlib-static-1.2.7-21.el7_9.i686.rpm
zlib-static-1.2.7-21.el7_9.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
zlib-1.2.7-21.el7_9.src.rpm
x86_64:
zlib-1.2.7-21.el7_9.i686.rpm
zlib-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
zlib-devel-1.2.7-21.el7_9.i686.rpm
zlib-devel-1.2.7-21.el7_9.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
minizip-1.2.7-21.el7_9.i686.rpm
minizip-1.2.7-21.el7_9.x86_64.rpm
minizip-devel-1.2.7-21.el7_9.i686.rpm
minizip-devel-1.2.7-21.el7_9.x86_64.rpm
zlib-debuginfo-1.2.7-21.el7_9.i686.rpm
zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm
zlib-static-1.2.7-21.el7_9.i686.rpm
zlib-static-1.2.7-21.el7_9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-37434
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZAcuDNzjgjWX9erEAQhBfxAAnzhxAmg+iqzHC7pYiVpoAR4rHumYqU06
6mzA0Y2UcTuzx/baoTpN2lxDJlKcJxijzXAVFDVK/FMfxeznMSl5LziNzdc07Vb0
rlNzQ0UXCaRAOVrHI4cWIi+XOLnwfFT+3ZzLGnIni6ZvdMroQCNJ2AlfLCeQwZ4M
59JZeHsYMJTg2E/sgQ9KALmCA+g+XVPmjrigoEG2DSOgXS/65t0SQ0DvMDeN8nT2
G9fWqBwDZpJcgqUTDI/5JSQ0kgENR4KLmnxbRJETHvydH+0LBlthqNSGmEWuVJYe
/Uw/YoffoP3tDzITzJEk5PdN6Y53atG25haf7wLmKWmfWdd2sfNqIOWZN7iUrpGG
V/pWF0kamiyrJ3CzLCr73hKWwaN3+tKyX5NlwFyKg67EwujAVS8upcGLgCCy/TDc
VuvvK6JiXgz0ieqhfoUXLOw4blF30OnUWWe2WHNTmXxEagRWFDmcyau0+xCs6ZtI
0e/9w8fC8qG79T8tlfM3QbYljHeyDwYRLu8S4D00eQD/KBRTren40qhDiYMjcvtQ
hAgDKEkcDR1cKDgalHCNpEWN+WWJdQbCetrAzkqinbVnjXVtNlrVQrgQrQF8RvsA
4vKUM3m4sedi7CblWgtPtUU4KiLNlq2oF03RjrVnW1FohuOJ8oRQ4pnb/5iZ9b1h
huKrzrky4/I=yKEJ
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Ubuntu Security Notice 6736-1 - It was discovered that zlib, vendored in klibc, incorrectly handled pointer arithmetic. An attacker could use this issue to cause klibc to crash or to possibly execute arbitrary code. Danilo Ramos discovered that zlib, vendored in klibc, incorrectly handled memory when performing certain deflating operations. An attacker could use this issue to cause klibc to crash or to possibly execute arbitrary code.
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...
The bundle management subsystem within OpenHarmony-v3.1.4 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause a DoS attack to the system when installing a malicious HAP package.
Red Hat Advanced Cluster Management for Kubernetes 2.6.3 General Availability release images, which provide security updates, fix bugs, and update container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3517: nodejs-minimatch: ReDoS via the braceExpand function * CVE-2022-41912: crewjam/saml: Authentication bypass when processing SAML responses containing multiple Assertion elements
Red Hat Security Advisory 2022-8938-01 - Version 1.26.0 of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.8, 4.9, 4.10, and 4.11. This release includes security and bug fixes, and enhancements.
An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-37434: zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
Red Hat Security Advisory 2022-7314-01 - The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Issues addressed include buffer over-read and buffer overflow vulnerabilities.
Red Hat Security Advisory 2022-7201-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.12. Issues addressed include a code execution vulnerability.
Red Hat OpenShift Container Platform release 4.11.12 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-26945: go-getter: command injection vulnerability * CVE-2022-30321: go-getter: unsafe download (issue 1 of 3) * CVE-2022-30322: go-getter: unsafe download (issue 2 of 3) * CVE-2022-30323: go-getter: unsafe download (issue 3 of 3)
This issue was addressed with improved entitlements. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to record audio using a pair of connected AirPods.
Apple Security Advisory 2022-10-27-12 - watchOS 9.1 addresses code execution, out of bounds write, and spoofing vulnerabilities.
Ubuntu Security Notice 5573-1 - Evgeny Legerov discovered that zlib incorrectly handled memory when performing certain inflate operations. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code.
Ubuntu Security Notice 5570-1 - Evgeny Legerov discovered that zlib incorrectly handled memory when performing certain inflate operations. An attacker could use this issue to cause zlib to crash, resulting in a denial of service, or possibly execute arbitrary code.