CVE-2023-45853

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-45853

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-45853.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-45853

Aliases

GHSA-mq29-j5xf-cjwr

Related

Published

2023-10-14T02:15:09Z

Modified

2024-10-12T11:09:42.405065Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

References

Affected packages

Alpine:v3.15 / zlib

Package

Name: zlib
Purl: pkg:apk/alpine/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.16 / zlib

Package

Name: zlib
Purl: pkg:apk/alpine/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.17 / zlib

Package

Name: zlib
Purl: pkg:apk/alpine/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.18 / zlib

Package

Name: zlib
Purl: pkg:apk/alpine/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.19 / zlib

Package

Name: zlib
Purl: pkg:apk/alpine/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Alpine:v3.20 / zlib

Package

Name: zlib
Purl: pkg:apk/alpine/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0

Debian:11 / minizip

Package

Name: minizip
Purl: pkg:deb/debian/minizip?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1-8+deb11u1

Affected versions

1.*

1.1-8

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / minizip

Package

Name: minizip
Purl: pkg:deb/debian/minizip?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1-8+deb12u1

Affected versions

1.*

1.1-8

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / zlib

Package

Name: zlib
Purl: pkg:deb/debian/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:1.*

1:1.2.11.dfsg-2

1:1.2.11.dfsg-2+deb11u1

1:1.2.11.dfsg-2+deb11u2

1:1.2.11.dfsg-3

1:1.2.11.dfsg-4

1:1.2.11.dfsg-4.1

1:1.2.13.dfsg-1

1:1.2.13.dfsg-2

1:1.2.13.dfsg-3

1:1.3.dfsg-1

1:1.3.dfsg-2

1:1.3.dfsg-3

1:1.3.dfsg-3.1~exp1

1:1.3.dfsg-3.1

1:1.3.dfsg+really1.3.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / zlib

Package

Name: zlib
Purl: pkg:deb/debian/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:1.*

1:1.2.13.dfsg-1

1:1.2.13.dfsg-2

1:1.2.13.dfsg-3

1:1.3.dfsg-1

1:1.3.dfsg-2

1:1.3.dfsg-3

1:1.3.dfsg-3.1~exp1

1:1.3.dfsg-3.1

1:1.3.dfsg+really1.3.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / zlib

Package

Name: zlib
Purl: pkg:deb/debian/zlib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:1.3.dfsg-2

Affected versions

1:1.*

1:1.2.13.dfsg-1

1:1.2.13.dfsg-2

1:1.2.13.dfsg-3

1:1.3.dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/madler/zlib

Affected ranges

Type: GIT
Repo: https://github.com/madler/zlib
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

09155eaa2f9270dc4ed1fa13e2b4b2613e6e4851

Affected versions

v0.*

v0.71

v0.79

v0.8

v0.9

v0.91

v0.92

v0.93

v0.94

v0.95

v0.99

v1.*

v1.0-pre

v1.0.1

v1.0.2

v1.0.4

v1.0.5

v1.0.7

v1.0.8

v1.0.9

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.1.4

v1.2.0

v1.2.0.1

v1.2.0.2

v1.2.0.3

v1.2.0.4

v1.2.0.5

v1.2.0.6

v1.2.0.7

v1.2.0.8

v1.2.1

v1.2.1.1

v1.2.1.2

v1.2.10

v1.2.11

v1.2.12

v1.2.13

v1.2.2

v1.2.2.1

v1.2.2.2

v1.2.2.3

v1.2.2.4

v1.2.3

v1.2.3.1

v1.2.3.2

v1.2.3.3

v1.2.3.4

v1.2.3.5

v1.2.3.6

v1.2.3.7

v1.2.3.8

v1.2.3.9

v1.2.4

v1.2.4-pre1

v1.2.4-pre2

v1.2.4.1

v1.2.4.2

v1.2.4.3

v1.2.4.4

v1.2.4.5

v1.2.5

v1.2.5.1

v1.2.5.2

v1.2.5.3

v1.2.6

v1.2.6.1

v1.2.7

v1.2.7.1

v1.2.7.2

v1.2.7.3

v1.2.8

v1.2.9

v1.3