Description
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | aide | 0.10-6.1.1 | — |
| Debian 14 | bacula | 1.36.3-2 | — |
| Debian 14 | dpkg | 1.13.11 | — |
| Debian 14 | dump | 0.4b40-1 | — |
| Debian 14 | libphysfs | 1.0.0-5 | — |
| Debian 14 | pvpgn | 1.7.8-2 | — |
| Debian 14 | rpm | 4.0.4-31.1 | — |
| Debian 14 | sash | 3.7-6 | — |
| Debian 14 | texmacs | 1:1.0.5-3 | — |
| Debian 14 | zlib | 1:1.2.2-7 | — |
| Debian 14 | zsync | 0.4.0-2 | — |
| Debian 13 | aide | 0.10-6.1.1 | — |
| Debian 13 | bacula | 1.36.3-2 | — |
| Debian 13 | dpkg | 1.13.11 | — |
| Debian 13 | dump | 0.4b40-1 | — |
| Debian 13 | libphysfs | 1.0.0-5 | — |
| Debian 13 | pvpgn | 1.7.8-2 | — |
| Debian 13 | rpm | 4.0.4-31.1 | — |
| Debian 13 | sash | 3.7-6 | — |
| Debian 13 | texmacs | 1:1.0.5-3 | — |
| Debian 13 | zlib | 1:1.2.2-7 | — |
| Debian 13 | zsync | 0.4.0-2 | — |
| Debian 12 | aide | 0.10-6.1.1 | — |
| Debian 12 | bacula | 1.36.3-2 | — |
| Debian 12 | dpkg | 1.13.11 | — |
| Debian 12 | dump | 0.4b40-1 | — |
| Debian 12 | libphysfs | 1.0.0-5 | — |
| Debian 12 | pvpgn | 1.7.8-2 | — |
| Debian 12 | rpm | 4.0.4-31.1 | — |
| Debian 12 | sash | 3.7-6 | — |
| Debian 12 | zlib | 1:1.2.2-7 | — |
| Debian 12 | zsync | 0.4.0-2 | — |
| Debian 3.1 | sash | 3.7-5sarge1 | DSA-1026-1 |
| Debian 3.1 | zlib | 1:1.2.2-4.sarge.1 | DSA-740-1 |
| Debian 3.1 | zsync | 0.3.3-1.sarge.1 | DSA-797-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | zlib +1 | 1.2.1.2-1.1 | RHSA-2005:569 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 5 | rhn_solaris_bootstrap_5_0_2_3 +1 | 1-0 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 4 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0525 |
| Red Hat Network Satellite 4 | rhn_solaris_bootstrap_5_0_2_3 | 1-0 | RHSA-2008:0525 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | httrack | 3.48.22-1.3 | openSUSE-SU-2024:10580-1 |
Advisories 11
- ICSA-26-202-06 Siemens CADRA CISA ICS & IT advisories · Jul 21, 2026
- NCSC-2026-0229 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jul 14, 2026
- SSA-470355 SSA-470355: Zlib and Foxit Vulnerabilities in CADRA Siemens ProductCERT · Jul 14, 2026
- RHSA-2005:569 Red Hat Security Advisory: zlib security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-797-1 zsync - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-740-1 zlib - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1026-1 sash - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10580-1 httrack-3.48.22-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2008:0629 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0525 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0264 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 101989 vendor-advisory
- DSA-1026 vendor-advisory
- 17236 third-party-advisory
- 20071018 Official Windows binaries of "curl" contain vulnerable zlib 1.2.2 (CAN-2005-2096) mailing-list
- hpux-secure-shell-dos(24064) vdb-entry
- APPLE-SA-2008-11-13 vendor-advisory
- 15949 third-party-advisory
- DSA-797 vendor-advisory
- GLSA-200509-18 vendor-advisory
- 1014398 vdb-entry
- MDKSA-2005:196 vendor-advisory
- oval:org.mitre.oval:def:1542 vdb-entry signature
- 20070404 VMSA-2007-0003 VMware ESX 3.0.1 and 3.0.0 server security updates mailing-list
- USN-151-3 vendor-advisory
- oval:org.mitre.oval:def:1262 vdb-entry signature
- 20071021 Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) mailing-list
- 18507 third-party-advisory
- 17054 third-party-advisory
- USN-148-1 vendor-advisory
- 14162 vdb-entry
- http://www.vmware.com/support/vi3/doc/esx-9916286-patch.html
- HPSBUX02090 vendor-advisory
- 31492 third-party-advisory
- MDKSA-2006:070 vendor-advisory
- RHSA-2008:0629 vendor-advisory
- 17225 third-party-advisory
- ADV-2007-1267 vdb-entry
- http://www.vmware.com/support/vi3/doc/esx-3616065-patch.html
- 18406 third-party-advisory
- 20071029 Windows binary of "Virtual Floppy Drive 2.1" contains vulnerable zlib (CAN-2005-2096) mailing-list
- 24788 third-party-advisory
- MDKSA-2005:112 vendor-advisory
- 32706 third-party-advisory
- oval:org.mitre.oval:def:11500 vdb-entry signature
- 17326 third-party-advisory
- ADV-2005-0978 vdb-entry
- 20071018 Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) mailing-list
- 20071029 Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) mailing-list
- APPLE-SA-2005-08-15 vendor-advisory
- 17516 third-party-advisory
- DSA-740 vendor-advisory
- ADV-2006-0144 vdb-entry
- http://support.apple.com/kb/HT3298
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162391
- RHSA-2005:569 vendor-advisory
- GLSA-200507-05 vendor-advisory
- 19597 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-016.htm
- 19550 third-party-advisory
- 18377 third-party-advisory
- APPLE-SA-2005-08-17 vendor-advisory
- FLSA:162680 vendor-advisory
- VU#680620 third-party-advisory
- 20071020 Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096) mailing-list