{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/alpinelinux3.18els/vex/2023/cve-2023-6992-els_os-alpinelinux3_18els.json" } ], "tracking": { "current_release_date": "2026-07-03T19:26:20Z", "generator": { "date": "2026-07-03T19:26:20Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2023-6992-ELS_OS-ALPINELINUX3.18ELS", "initial_release_date": "2023-01-01T00:00:00Z", "revision_history": [ { "date": "2023-01-01T00:00:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-05-14T12:32:33Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-05-14T18:24:23Z", "number": "3", "summary": "Update document" }, { "date": "2026-06-16T13:02:13Z", "number": "4", "summary": "Update document" }, { "date": "2026-07-03T19:26:20Z", "number": "5", "summary": "Update document" } ], "status": "final", "version": "5" }, "title": "Security update on CVE-2023-6992" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "zlib-doc-1.2.13-r0.x86_64", "product": { "name": "zlib-doc-1.2.13-r0.x86_64", "product_id": "zlib-doc-1.2.13-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib-doc@1.2.13-r0?arch=x86_64" } } }, { "category": "product_version", "name": "zlib-static-1.2.13-r0.x86_64", "product": { "name": "zlib-static-1.2.13-r0.x86_64", "product_id": "zlib-static-1.2.13-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib-static@1.2.13-r0?arch=x86_64" } } }, { "category": "product_version", "name": "zlib-dev-1.2.13-r0.x86_64", "product": { "name": "zlib-dev-1.2.13-r0.x86_64", "product_id": "zlib-dev-1.2.13-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib-dev@1.2.13-r0?arch=x86_64" } } }, { "category": "product_version", "name": "zlib-1.2.13-r0.x86_64", "product": { "name": "zlib-1.2.13-r0.x86_64", "product_id": "zlib-1.2.13-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib@1.2.13-r0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "zlib-doc-1.2.13-r0.aarch64", "product": { "name": "zlib-doc-1.2.13-r0.aarch64", "product_id": "zlib-doc-1.2.13-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib-doc@1.2.13-r0?arch=aarch64" } } }, { "category": "product_version", "name": "zlib-static-1.2.13-r0.aarch64", "product": { "name": "zlib-static-1.2.13-r0.aarch64", "product_id": "zlib-static-1.2.13-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib-static@1.2.13-r0?arch=aarch64" } } }, { "category": "product_version", "name": "zlib-dev-1.2.13-r0.aarch64", "product": { "name": "zlib-dev-1.2.13-r0.aarch64", "product_id": "zlib-dev-1.2.13-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib-dev@1.2.13-r0?arch=aarch64" } } }, { "category": "product_version", "name": "zlib-1.2.13-r0.aarch64", "product": { "name": "zlib-1.2.13-r0.aarch64", "product_id": "zlib-1.2.13-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/alpine/zlib@1.2.13-r0?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_name", "name": "Alpine Linux 3.18", "product": { "name": "Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18", "product_identification_helper": { "cpe": "cpe:2.3:o:alpinelinux:alpine_linux:3.18:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Alpine Linux" } ], "category": "vendor", "name": "Alpine Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "product": { "name": "zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "product_id": "zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib-doc@1.2.13.tuxcare.els1-r0?arch=x86_64" } } }, { "category": "product_version", "name": "zlib-static-1.2.13.tuxcare.els1-r0.x86_64", "product": { "name": "zlib-static-1.2.13.tuxcare.els1-r0.x86_64", "product_id": "zlib-static-1.2.13.tuxcare.els1-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib-static@1.2.13.tuxcare.els1-r0?arch=x86_64" } } }, { "category": "product_version", "name": "zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "product": { "name": "zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "product_id": "zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib-dev@1.2.13.tuxcare.els1-r0?arch=x86_64" } } }, { "category": "product_version", "name": "zlib-1.2.13.tuxcare.els1-r0.x86_64", "product": { "name": "zlib-1.2.13.tuxcare.els1-r0.x86_64", "product_id": "zlib-1.2.13.tuxcare.els1-r0.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib@1.2.13.tuxcare.els1-r0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "product": { "name": "zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "product_id": "zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib-doc@1.2.13.tuxcare.els1-r0?arch=aarch64" } } }, { "category": "product_version", "name": "zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "product": { "name": "zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "product_id": "zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib-static@1.2.13.tuxcare.els1-r0?arch=aarch64" } } }, { "category": "product_version", "name": "zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "product": { "name": "zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "product_id": "zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib-dev@1.2.13.tuxcare.els1-r0?arch=aarch64" } } }, { "category": "product_version", "name": "zlib-1.2.13.tuxcare.els1-r0.aarch64", "product": { "name": "zlib-1.2.13.tuxcare.els1-r0.aarch64", "product_id": "zlib-1.2.13.tuxcare.els1-r0.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/zlib@1.2.13.tuxcare.els1-r0?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "zlib-doc-1.2.13.tuxcare.els1-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.x86_64" }, "product_reference": "zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-doc-1.2.13-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.x86_64" }, "product_reference": "zlib-doc-1.2.13-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-doc-1.2.13.tuxcare.els1-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.aarch64" }, "product_reference": "zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-doc-1.2.13-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.aarch64" }, "product_reference": "zlib-doc-1.2.13-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-static-1.2.13.tuxcare.els1-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.x86_64" }, "product_reference": "zlib-static-1.2.13.tuxcare.els1-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-static-1.2.13-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-static-1.2.13-r0.x86_64" }, "product_reference": "zlib-static-1.2.13-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-static-1.2.13.tuxcare.els1-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.aarch64" }, "product_reference": "zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-static-1.2.13-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-static-1.2.13-r0.aarch64" }, "product_reference": "zlib-static-1.2.13-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-dev-1.2.13.tuxcare.els1-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.x86_64" }, "product_reference": "zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-dev-1.2.13-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.x86_64" }, "product_reference": "zlib-dev-1.2.13-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-dev-1.2.13.tuxcare.els1-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.aarch64" }, "product_reference": "zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-dev-1.2.13-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.aarch64" }, "product_reference": "zlib-dev-1.2.13-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-1.2.13.tuxcare.els1-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.aarch64" }, "product_reference": "zlib-1.2.13.tuxcare.els1-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-1.2.13-r0.aarch64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-1.2.13-r0.aarch64" }, "product_reference": "zlib-1.2.13-r0.aarch64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-1.2.13.tuxcare.els1-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.x86_64" }, "product_reference": "zlib-1.2.13.tuxcare.els1-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" }, { "category": "default_component_of", "full_product_name": { "name": "zlib-1.2.13-r0.x86_64 as a component of Alpine Linux 3.18", "product_id": "Alpine-Linux-3.18:zlib-1.2.13-r0.x86_64" }, "product_reference": "zlib-1.2.13-r0.x86_64", "relates_to_product_reference": "Alpine-Linux-3.18" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-6992", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow.\nA local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software.\nPatches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.\n", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Alpine-Linux-3.18:zlib-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-6992" }, { "category": "external", "summary": "https://github.com/cloudflare/zlib", "url": "https://github.com/cloudflare/zlib" }, { "category": "external", "summary": "https://github.com/cloudflare/zlib/security/advisories/GHSA-vww9-j87r-4cqh", "url": "https://github.com/cloudflare/zlib/security/advisories/GHSA-vww9-j87r-4cqh" } ], "release_date": "2024-01-04T12:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-05-14T17:33:34.584001Z", "details": "This issue only affects Cloudflare’s fork of zlib; the standard upstream zlib commonly packaged with Linux distributions is not impacted. Exploitation requires a local attacker to invoke compression with that specific fork using crafted input, and the documented effect is limited to availability (denial of service) with no confidentiality or integrity impact. In centrally managed enterprise VM/server environments where the Cloudflare fork is not explicitly installed or used for compression, the practical exposure is negligible, so this can be safely deprioritized.", "product_ids": [ "Alpine-Linux-3.18:zlib-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.x86_64" ] }, { "category": "no_fix_planned", "date": "2026-06-16T12:25:16.732432Z", "details": "- This CVE applies only to Cloudflare’s fork of zlib; upstream zlib used by standard Linux distribution packages is not affected, so it matters only if you have explicitly linked software against Cloudflare’s fork. \n- Exploitation is local-only during compression of attacker-supplied input and affects availability (DoS) without confidentiality or integrity impact. \n- Given the narrow precondition (use of a non-default fork) and DoS-only outcome, this can be safely deprioritized for managed enterprise servers and VMs.", "product_ids": [ "Alpine-Linux-3.18:zlib-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Alpine-Linux-3.18:zlib-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-dev-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-doc-1.2.13.tuxcare.els1-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13-r0.x86_64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.aarch64", "Alpine-Linux-3.18:zlib-static-1.2.13.tuxcare.els1-r0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }