WaratekVRT Sign in

CVE-2018-25032 zlib

Affected softwarezlib
Severity7.5 High CVSS 3.1 3 scores
WeaknessOut-of-bounds write (CWE-787)
Published25 Mar 2022
Updated14 Oct 2026

Description

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: yes, technical impact: partial.
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 52% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Trinadh465/external_zlib_4.4_CVE-2018-25032 1 2022-09-29

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CISA-ADP Secondary
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Siebel CRM / Siebel Core (zlib) (23.6 and prior)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Database Server / Oracle Database (zlib) (19c, 21c)
Oracle Fusion Middleware / Centralized Thirdparty Jars (zlib) (12.2.1.4.0)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Communications / DBTier (zlib) (22.1.0, 22.2.0)
Oracle Communications / Installer (zlib) (22.1.1)
Oracle Communications / Platform (zlib) (8.6.0.0)
Oracle Communications / System (zlib) (8.4, 9.0, 9.1)
Oracle Fusion Middleware / Outside In Filters (Python) (8.5.6)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Communications / CNC Console (zlib) (22.1.2)
Oracle Communications / NEF (zlib) (22.1.1)
Oracle Communications / SEPP (zlib) (22.1.1)
Oracle Communications / UDR (zlib) (22.2.0)
Oracle MySQL / Server: Compiling (zlib) (5.7.38 and prior, 8.0.29 and prior)
Oracle PeopleSoft / PeopleSoft CDA (zlib) (8.58, 8.59)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications CNC Console (zlib) 22.1.2 22.1.2
Oracle Communications DBTier (zlib) 22.1.0, 22.2.0 22.1.0 · 22.2.0
Oracle Communications Installer (zlib) 22.1.1 22.1.1
Oracle Communications NEF (zlib) 22.1.1 22.1.1
Oracle Communications Platform (zlib) 8.6.0.0 8.6.0.0
Oracle Communications SEPP (zlib) 22.1.1 22.1.1
Oracle Communications System (zlib) 8.4, 9.0, 9.1 8.4 · 9.0 · 9.1
Oracle Communications UDR (zlib) 22.2.0 22.2.0
Oracle Database Server Oracle Database (zlib) 19c, 21c 19 · 21
Oracle Fusion Middleware Centralized Thirdparty Jars (zlib) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Outside In Filters (Python) 8.5.6 8.5.6
Oracle MySQL Server: Compiling (zlib) 5.7.38 and prior, 8.0.29 and prior
Oracle PeopleSoft PeopleSoft CDA (zlib) 8.58, 8.59 8.58 · 8.59
Oracle Siebel CRM Siebel Core (zlib) 23.6 and prior

Products and versions

27 products, 61 version entries
SourceVendorProductSchemeAffected versions
nvd apple mac os x generic ≥ 10.15 and ＜ 10.15.7 · 10.15.7 · 10.15.7:security_update_2020 · 10.15.7:security_update_2020-001 · 10.15.7:security_update_2020-005 · 10.15.7:security_update_2020-007 · 10.15.7:security_update_2021-001 · 10.15.7:security_update_2021-002 · 10.15.7:security_update_2021-003 · 10.15.7:security_update_2021-006 · 10.15.7:security_update_2021-007 · 10.15.7:security_update_2021-008 · 10.15.7:security_update_2022-001 · 10.15.7:security_update_2022-002 · 10.15.7:security_update_2022-003
nvd apple macos generic ≥ 11.0 and ＜ 11.6.6 · ≥ 12.0.0 and ＜ 12.4
nvd azul zulu generic 6.45 · 7.52 · 8.60 · 11.54 · 13.46 · 15.38 · 17.32
nvd debian debian linux generic 9.0 · 10.0 · 11.0
nvd fedoraproject fedora generic 34 · 35 · 36
nvd goto gotoassist generic ＜ 11.9.18
nvd mariadb mariadb generic ≥ 10.3.0 and ＜ 10.3.36 · ≥ 10.4.0 and ＜ 10.4.26 · ≥ 10.5.0 and ＜ 10.5.17 · ≥ 10.6.0 and ＜ 10.6.9 · ≥ 10.7.0 and ＜ 10.7.5 · ≥ 10.8.0 and ＜ 10.8.4 · ≥ 10.9.0 and ＜ 10.9.2
nvd netapp active iq unified manager generic any version
nvd netapp e-series santricity os controller generic ≥ 11.0.0 and ≤ 11.70.2
nvd netapp h300s firmware generic any version
nvd netapp h410c firmware generic any version
nvd netapp h410s firmware generic any version
nvd netapp h500s firmware generic any version
nvd netapp h700s firmware generic any version
nvd netapp hci compute node generic any version
nvd netapp management services for element software generic any version
nvd netapp oncommand workflow automation generic any version
nvd netapp ontap select deploy administration utility generic any version
nvd nokogiri nokogiri generic ＜ 1.13.4
nvd python python generic ≥ 3.7.0 and ＜ 3.7.14 · ≥ 3.8.0 and ＜ 3.8.14 · ≥ 3.9.0 and ＜ 3.9.13 · ≥ 3.10.0 and ＜ 3.10.5
nvd siemens scalance sc622-2c firmware generic ＜ 3.0
nvd siemens scalance sc626-2c firmware generic ＜ 3.0
nvd siemens scalance sc632-2c firmware generic ＜ 3.0
nvd siemens scalance sc636-2c firmware generic ＜ 3.0
nvd siemens scalance sc642-2c firmware generic ＜ 3.0
nvd siemens scalance sc646-2c firmware generic ＜ 3.0
nvd zlib zlib generic ≥ 1.2.2.2 and ＜ 1.2.12

References

URLTags
http://seclists.org/fulldisclosure/2022/May/33 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/38 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/03/25/2 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/03/26/1 Exploit, Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf Third Party Advisory
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 Patch, Third Party Advisory
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 Patch, Third Party Advisory
https://github.com/madler/zlib/issues/605 Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html Mailing List, Third Party Advisory

Timeline
Published2022-03-25By the CVE Program.
NVD record modified2026-10-14NVD's own last-modified date for this record.