CVE catalog

CVE-2018-1000637

zutils: CVE-2018-1000637

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.67% · Oct 25, 2026

zutils version prior to version 1.8-pre2 contains a Buffer Overflow vulnerability in zcat that can result in Potential denial of service or arbitrary code execution. This attack appear to be exploitable via the victim openning a crafted compressed file. This vulnerability appears to have been fixed in 1.8-pre2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzutilssid1.16-1fixed
Debianzutilsforky1.16-1fixed
Debianzutilstrixie1.14-5fixed
Debianzutilsbookworm1.12-2fixed
Ubuntuzutils16.041.4-1vulnerable
Ubuntuzutils18.041.6-3vulnerable
Ubuntuzutils18.041.6-4vulnerable
Ubuntuzutils18.041.6-5vulnerable
Ubuntuzutils18.041.6-6vulnerable
Ubuntuzutils18.041.7-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzutilssourcesid1.7-3not yet assignedNot reported[902936]
Debianzutilssourceforky1.7-3not yet assignedNot reported[902936]
Debianzutilssourcetrixie1.7-3not yet assignedNot reported[902936]
Debianzutilssourcebookworm1.7-3not yet assignedNot reported[902936]

[Debian bug #902936]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [zutils]Fixed
    Details (2)

    • 1.12-2 · amd64 · bookworm

      Fixed · Fixed: 1.7-3

      dsa · zutils · debian · bookworm; dsa · zutils · debian · 12

    • 1.12-2 · arm64 · bookworm

      Fixed · Fixed: 1.7-3

      dsa · zutils · debian · bookworm; dsa · zutils · debian · 12

[Debian 13 (Trixie)]

  • [zutils]Fixed
    Details (2)

    • 1.14-5 · amd64 · trixie

      Fixed · Fixed: 1.7-3

      dsa · zutils · debian · 13

    • 1.14-5 · arm64 · trixie

      Fixed · Fixed: 1.7-3

      dsa · zutils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]