CVE-2022-37434
CRITICALzlib <= 1.2.12 - Heap-Based Buffer Overflow in inflate via Large Gzip Header Extra Field
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-37434. PoCs published by xen0bit, Trinadh465.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2022-37434, a heap-based buffer over-read or overflow vulnerability in zlib's inflate function. The exploit crafts a malicious gzip header with an excessively large extra field to trigger the vulnerability.
Description
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Exploits (2)
This repository contains a functional proof-of-concept exploit for CVE-2022-37434, a heap-based buffer over-read or overflow vulnerability in zlib's inflate function. The exploit crafts a malicious gzip header with an excessively large extra field to trigger the vulnerability.
The repository contains the standard zlib library source code without any exploit-specific modifications or proof-of-concept code for CVE-2022-37434. No exploit or vulnerability details are present.
References (27)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H