| Package | Affected versions | Patched versions |
|---|---|---|
| zlib | ≥ 3.1.0, < 3.1.2≥ 3.2.0, < 3.2.3< 3.0.1 | 3.1.23.2.33.0.1 |
| zlib | ≥ 3.1.0, < 3.1.2≥ 3.2.0, < 3.2.3< 3.0.1 | 3.1.23.2.33.0.1 |
A buffer overflow vulnerability exists in Zlib::GzipReader.
The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.
We recommend to update the zlib gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:
You can use gem update zlib to update it. If you are using bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile.
zlib gem 3.2.2 or lower
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free