CVE-2002-0059

CRITICAL

Zlib < 1.1.3 - Double Free

Title source: rule

Description

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

References (16)

Scores

CVSS v3 9.8
EPSS 0.3322
EPSS Percentile 96.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-415
Status draft

Affected Products (1)

zlib/zlib < 1.1.3

Timeline

Published Mar 15, 2002
Tracked Since Feb 18, 2026