CVE-2018-25032: 
MySQL vulnerability analysis and mitigation

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. This vulnerability was discovered by Danilo Ramos and was assigned CVE-2018-25032. The issue affects zlib versions 1.2.2.2 through 1.2.11 and was first reported in 2018, though the patch did not make it into a release until version 1.2.12 (CVE Details, GitHub Commit).

The vulnerability occurs in zlib's deflate handling when processing inputs with many distant matches. The bug was introduced in zlib 1.2.2.2 with the addition of the Z_FIXED option that forces the use of fixed Huffman codes. For rare inputs with a large number of distant matches, the pending buffer into which the compressed data is written can overwrite the distance symbol table which it overlays. This results in corrupted output due to invalid distances and can lead to out-of-bounds accesses (OSS Security, GitHub Commit).

Successful exploitation of this vulnerability could result in denial of service (DoS) or potentially the execution of arbitrary code if specially crafted input is processed. The bug can cause memory corruption and crash applications using zlib for compression (Debian Advisory, NetApp Advisory).

The vulnerability has been fixed in zlib version 1.2.12. The fix combines the distance buffer and literal/length buffers into a single symbol buffer, ensuring that three bytes of pending buffer space are opened up for each literal or length/distance pair consumed, instead of the previous two bytes. This prevents the pending buffer from overwriting the symbol table (GitHub Commit). Until patches can be applied, there are no known workarounds.

The vulnerability received significant attention after being rediscovered by Tavis Ormandy in March 2022, despite being initially found in 2018. Multiple major vendors and distributions including Apple, Debian, Fedora, and NetApp have issued security advisories and patches for their affected products (Apple Security, Debian Advisory).