Source: zlib Version: 1:1.3.dfsg+really1.3.2-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for zlib. CVE-2026-85091[0]: | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow | vulnerability in the gz_vacate() function when processing non- | blocking gzwrite() operations with stale external buffer pointers. | Attackers can trigger the overflow by calling gzprintf() or | gzvprintf() after a write stall, causing an unchecked memmove() to | write beyond the internal input buffer boundary. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-85091 https://www.cve.org/CVERecord?id=CVE-2026-85091 [1] https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490 [2] https://github.com/madler/zlib/commit/e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca Regards, Salvatore
