CVE-2003-0107 Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or poss...
HighCVSS 7.5
EPSS 26.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zlib | = 1.1.4 | No fix listed |
| debian/zlib(Debian:12) | < 1:1.1.4-10 | 1:1.1.4-10 |
| debian/zlib(Debian:13) | < 1:1.1.4-10 | 1:1.1.4-10 |
| debian/zlib(Debian:14) | < 1:1.1.4-10 | 1:1.1.4-10 |
References
- Debian Security Tracker CVE-2003-0107 vendor-advisory
- CLSA-2003:619 vendor-advisory
- JVN#78689801 third-party-advisory
- JVNDB-2015-000066 third-party-advisory
- lists.apple.com
- 20030223 poc zlib sploit just for fun :) mailing-list
- 20030224 Re: buffer overrun in zlib 1.1.4 mailing-list
- 20030225 [sorcerer-spells] ZLIB-SORCERER2003-02-25 mailing-list
- GLSA-200303-25 vendor-advisory
- 20030222 buffer overrun in zlib 1.1.4 exploit mailing-list
- 57405 vendor-advisory
- zlib-gzprintf-bo(11381) vdb-entry vendor-advisory
- VU#142121 third-party-advisory us-government-resource
- MDKSA-2003:033 vendor-advisory
- 6599 vdb-entry
- RHSA-2003:079 vendor-advisory
- RHSA-2003:081 vendor-advisory
- 6913 vdb-entry