Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

FLTK 1.3.8-1 may corrupt memory when compressing data

published 4 years ago
Summary

The FLTK library version 1.3.8-1 includes a component that uses an older version of the compression library zlib. When that compression library processes specially crafted input, it can cause memory errors that might lead to crashes or other unexpected behavior. Update FLTK to a version that uses zlib 1.2.12 or later, or apply the vendor’s recommended patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure fltk <= 1.3.8-1
Original advisory text
CVE-2018-25032 affecting package fltk 1.3.8-1
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published25 Mar 2022
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-45231 · OSV
Track software like this
Free during beta