A critical vulnerability, CVE-2022-37434, has been identified in the zlib library version 1.2.12, affecting various systems and applications that call the inflateGetHeader function. This vulnerability can lead to unexpected app termination or arbitrary code execution. It has been found in multiple configurations, including Fedora, Debian Linux, NetApp products, and Apple devices. The issue has been addressed with improved checks in recent updates.

How do I know if I'm affected?

If you're concerned about this vulnerability, it affects the zlib library through version 1.2.12. To know if you're impacted, check if your system or applications use this library and call the inflateGetHeader function. Affected configurations include specific versions of Fedora, Debian Linux, NetApp products, and Apple devices. For example, iOS 15.7.1 and iPadOS 15.7.1 are impacted. Keep in mind that only applications that call inflateGetHeader are affected, so some common applications may bundle the affected zlib source code but remain unaffected.

What should I do if I'm affected?

If you're affected by this vulnerability, take these steps: 1) Identify if your system or applications use the zlib library version 1.2.12 or earlier. 2) Check for updates and patches for your affected software. 3) Apply the updates as soon as possible. 4) Monitor security advisories for further information and recommendations.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-37434 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This critical vulnerability, found in the zlib library, can lead to unexpected app termination or arbitrary code execution. To protect your system, it's essential to identify if you're using the affected zlib library version, check for updates, and apply patches as soon as possible.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, an Out-of-bounds Write weakness, which can lead to denial of service or arbitrary code execution in affected systems and applications.

For more details

CVE-2022-37434 is a critical vulnerability in the zlib library, affecting various systems and applications. By addressing this issue, users can prevent unexpected app termination or arbitrary code execution. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• Full Disclosure: APPLE-SA-2022-10-27-1 iOS 15.7.1 and iPadOS 15.7.1

• [SECURITY] [DLA 3103-1] zlib security update

• [SECURITY] Fedora 36 Update: zlib-1.2.11-33.fc36

• [SECURITY] Fedora 36 Update: rsync-3.2.5-1.fc36