CVE-2002-0059

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Mar 15, 2002
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2002

CVE-2002-00607.5IRC connection tracking helper module in the netfilter subsystem for Linux 2.4.18-pre9 and earlier does not properly set the mask for conntrCVE-2002-00617.5Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharactersCVE-2002-00627.2Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, relaCVE-2002-00637.5Buffer overflow in ippRead function of CUPS before 1.1.14 may allow attackers to execute arbitrary code via long attribute names or languageCVE-2002-00647.2Funk Software Proxy Host 3.x is installed with insecure permissions for the registry and the file system.CVE-2002-00657.2Funk Software Proxy Host 3.x uses weak encryption for the Proxy Host password, which allows local users to gain privileges by recovering theCVE-2002-00667.5Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access coCVE-2002-00677.5Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcp_port 0" is specified in squid.conf, which could allow remote aCVE-2002-00687.5Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code with an fCVE-2002-00692.6Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service.CVE-2002-00707.6Buffer overflow in Windows Shell (used as the Windows Desktop) allows local and possibly remote attackers to execute arbitrary code via a cuCVE-2002-00717.5Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attacke
CVE-2002-0059: Critical severity, CVSS 9.8 | Vulnix