zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
{ "vanir_signatures": [ { "target": { "file": "deflate.h" }, "signature_type": "Line", "source": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531", "id": "CVE-2018-25032-0fc51149", "signature_version": "v1", "deprecated": false, "digest": { "line_hashes": [ "141723864317747925058336557003436481538", "67358590013236664675391494614848539802", "302908053743602711134143963280417879769", "63246384868305385028609490170472494591", "197696826748605258549566037975095074473", "178728171548848499097530913039572405075", "239441329185959104795351783318844433913", "113880934804577714788433535757505248367", "186776389272425000966978050927088826772", "230224791616736251459435186768860733470", "315011761030768229289512186357498758174", "7512418680227091364171781841596870314", "337472628272406866696043769040470883323", "179952937507251961654454387812217343994", "52432553690372258283590198874603137476", "48216828784747377600525248297419610319", "167386283172557197139527567126230857405", "52989523748966647699789142542497781711", "104284105052473956938937706929463953108", "61514555653805824093844711119884087722", "261275755014155220492152028762043809052", "223152562692181219827932737786788727815", "251997642670575075602858006756589800988", "263015191860464613075683134237649416842" ], "threshold": 0.9 } }, { "target": { "file": "deflate.c" }, "signature_type": "Line", "source": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531", "id": "CVE-2018-25032-561ef634", "signature_version": "v1", "deprecated": false, "digest": { "line_hashes": [ "95527534056965999805195222966911308931", "40377084281797978781809953378357646014", "169925438748705490661276078601557135147", "263420814224869622578870971980400825129", "55947360462560040236426082660137443332", "278112257920924414324335574811393650708", "21474087875977361105189073914296703668", "213530804123451704796055807666465775624", "128861107472703546063652180908920042922", "320638403681128379778124806992206626438", "164212191260478141579821974251646259037", "158218631382871507579401750610032717544", "208663743624237816202707950212939183677", "319931111585565094142139107543831628965", "304585962814257033681920331726959626340", "288091319656971273051039017292829193524", "314181257043960388891286509408608660270", "281348945158634912779652987617921208801", "251371988921103670719178198170621178148", "89228518188905023274567953372492642384", "11154538915074374363518656421808658793", "138692121015815931217353122397344876623", "331635599745367811337070131292552797279", "140300391123739811445147671784482577305", "296162210247165598639726066625577764646", "202179798597446626580721641273616384631", "227213397709513200874059200915662776630", "98431677271186169320922500200198031189", "32929428429162941793112522035732042956", "186318132831561585867179212354734263910", "147675632396734393261281517662783924275", "30425654285744897008841363475340594789", "264248193964434628768022975059497886822", "157856874409156161731194607198107812714", "7477895630416423579748747537469175639", "287319464347230740037567272479812888874", "124040230490321498039465106068895104028", "157856874409156161731194607198107812714", "7477895630416423579748747537469175639", "287319464347230740037567272479812888874", "124040230490321498039465106068895104028", "157856874409156161731194607198107812714", "7477895630416423579748747537469175639", "287319464347230740037567272479812888874", "124040230490321498039465106068895104028", "157856874409156161731194607198107812714", "7477895630416423579748747537469175639", "287319464347230740037567272479812888874", "124040230490321498039465106068895104028" ], "threshold": 0.9 } }, { "target": { "function": "_tr_tally_dist", "file": "deflate.h" }, "signature_type": "Function", "source": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531", "id": "CVE-2018-25032-6531a8a2", "signature_version": "v1", "deprecated": false, "digest": { "function_hash": "183577064079204038223351938506323241649", "length": 405.0 } }, { "target": { "function": "_tr_tally_lit", "file": "deflate.h" }, "signature_type": "Function", "source": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531", "id": "CVE-2018-25032-b8d1705b", "signature_version": "v1", "deprecated": false, "digest": { "function_hash": "197602208888546417884389429356439392046", "length": 258.0 } }, { "target": { "function": "find_set", "file": "sql/strfunc.cc" }, "signature_type": "Function", "source": "https://github.com/mariadb/server/commit/faddcf3c395da640b760c3f701f5bc1f3baae6c4", "id": "CVE-2018-25032-bab28f5d", "signature_version": "v1", "deprecated": false, "digest": { "function_hash": "96567548985656349046472553596954460768", "length": 1094.0 } }, { "target": { "file": "trees.c" }, "signature_type": "Line", "source": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531", "id": "CVE-2018-25032-eaa7586e", "signature_version": "v1", "deprecated": false, "digest": { "line_hashes": [ "275729980329486640864871635647500674241", "36310519418943524490990280449166385695", "83093560647248392120903241051961354577", "15559684812814601637683710660364447171", "124457097401623797224694666739951043404", "170040189433616466552056819666133826240", "37728164962488204105515535869221895289", "318974904746630559889012130340606527190", "203420035528872593117691111285885472961", "281432424335107080520185873839181488805", "263446684365866307309878265978833443492", "180904249670093724273103375739725429001", "157392680355378625847726856020041717172", "98431604612329735115473080898565296646", "104463810397730140048307147091942102116", "695108473130459805652151375261153836", "260256238173438554145983822103816123323", "55563018243523296312660524556172760836", "54521747130159132355809839883599176076", "284183267864467478325414241930994380573", "317226498807644787217983491378508508945", "294461928729349457650093699995822630553", "23843344622014854395634360508374769167", "181349001937904947627317717850091119788", "247642861271588735194604471829776102269", "241241107559885235631428206071269883582", "71389195349489551025665626279939797786", "305697195570412995838641631157082682039", "271659869836972134851981129039061253853", "114017433329083463939489002363684398859", "243284635003099158607636791722620798624", "254090499493632955889431416931979758708", "280994057955809864110825216049260260568", "189542929523420146747088537002250990400", "264830883514038256125886789433363475321", "208672719471545000741289466095903292417", "81191180630014765923302463762403452970", "289565422209295032945524427625623770663", "228817909144996188778908253764289710103", "324270781134441179326963692477977264994", "228478318158434263888083744272467519845", "314337177623198088727946449990923729069", "306782173303871066853395012939350031227", "236509791217529222740138786750656921902", "150138996121765241686509325879686315727", "144184067178449835701555955902902643889", "95046897030385651463719084436879453213", "234560781543869297759876207381494709077" ], "threshold": 0.9 } }, { "target": { "file": "sql/strfunc.cc" }, "signature_type": "Line", "source": "https://github.com/mariadb/server/commit/faddcf3c395da640b760c3f701f5bc1f3baae6c4", "id": "CVE-2018-25032-ee10862f", "signature_version": "v1", "deprecated": false, "digest": { "line_hashes": [ "271363707396860767418283350345897486504", "120596951573328682502907908502941671745", "115421961338400510566446524145876737974", "64074615696916198601226435566349591945" ], "threshold": 0.9 } } ] }