CVE-2023-6992

Katalog CVE

CVSS 5.5 · Medium EPSS 0,24%

Kerentanan Improper Input Validation pada cloudflare zlib. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Rincian

Terbit di NVD

4 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-122: Heap-based Buffer Overflow
CWE-126: Buffer Over-read
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cloudflare/zlib/security/advisories/GHSA-vww9-j87r-4cqh patch · advisory pihak ketiga
• https://github.com/cloudflare/zlib product