Critical severity · published Mar 15, 2002
CVE-2002-0059
The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double…
9.8
CVSS
9.7%
EPSS
No
On KEV
Description
The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZL
Zlib · Zlib
through 1.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0059
Broken Link
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000469
Broken Link
http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:022
Broken Link
http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt
Third Party Advisory
http://www.cert.org/advisories/CA-2002-07.html
Broken Link
http://www.debian.org/security/2002/dsa-122
More from Zlib
9.8
CVE-2023-45853
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field
9.8
CVE-2022-37434
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field
9.8
CVE-2016-9843
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation
9.8
CVE-2016-9841
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
8.8
CVE-2016-9842
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers