CVE-2016-9843

In zlib up to version 1.3, the MiniZip component has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.

zlib through version 1.2.12 has a heap-based buffer over-read or buffer overflow in the inflate function in inflate.c due to a large gzip header extra field. Only applications that call inflateGetHeader are affected.

A vulnerability in zlib before version 1.2.12 allows memory corruption during data compression when the input contains many distant matches.

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

In zlib version 1.2.8, the file inffast.c contains a vulnerability due to improper pointer arithmetic. This could allow context-dependent attackers to cause unspecified impacts.

In zlib version 1.2.8, the inftrees.c file contains a vulnerability due to improper pointer arithmetic. This may allow context-dependent attackers to cause unspecified impacts.

A vulnerability in zlib version 1.2 and later allows remote attackers to cause a denial of service (crash) by sending a crafted compressed stream with an incomplete code description of a length greater than 1, leading to a buffer overflow. This is demonstrated using a crafted PNG file.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

A global buffer overflow vulnerability exists in the untgz utility (contrib/untgz) in zlib versions up to and including 1.3.1.2. The issue is limited to the standalone demonstration tool and does not affect the core zlib compression library. The flaw occurs when a user executes untgz with an excessively long archive name on the command line, causing an out-of-bounds write in a fixed-size global buffer.