Re: zlib before 1.2.12 allows memory corruption (CVE-2018-25032)

2022-05-02 Thread Vitaly Provodin
Volker, Bernd, thanks for the replies - they were really useful Vitaly > On 27 Apr 2022, at 14:59, Volker Simonis wrote: > > Hi Bernd, Vitaly, > > Amazon Corretto [1] also includes the fixes for CVE-2018-25032. This > is our statement: > > "Based upon our analysis, OpenJDK/Corretto is not a

Re: zlib before 1.2.12 allows memory corruption (CVE-2018-25032)

2022-04-27 Thread Volker Simonis
Hi Bernd, Vitaly, Amazon Corretto [1] also includes the fixes for CVE-2018-25032. This is our statement: "Based upon our analysis, OpenJDK/Corretto is not affected by CVE-2018-25032, because the zlib "memLevel" parameter is not settable and is fixed at 8, and the usage of the Z_FIXED strategy is