Description
The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zlib | 1:1.2.1.1-6 | — |
| Debian 13 | zlib | 1:1.2.1.1-6 | — |
| Debian 12 | zlib | 1:1.2.1.1-6 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | httrack | 3.48.22-1.3 | openSUSE-SU-2024:10580-1 |
Advisories 1
- openSUSE-SU-2024:10580-1 httrack-3.48.22-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 11051 vdb-entry
- 9361 vdb-entry
- 9360 vdb-entry
- GLSA-200408-26 vendor-advisory
- 17054 third-party-advisory
- CLA-2004:865 vendor-advisory
- zlib-inflate-inflateback-dos(17119) vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=252253
- VU#238678 third-party-advisory
- SUSE-SA:2004:029 vendor-advisory
- 1011085 vdb-entry
- CLA-2004:878 vendor-advisory
- MDKSA-2004:090 vendor-advisory
- 11129 third-party-advisory
- SSA:2004-278 vendor-advisory
- 18377 third-party-advisory
- FLSA:2043 vendor-advisory
- 20040825 [OpenPKG-SA-2004.038] OpenPKG Security Advisory (zlib) mailing-list