Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM92457FA7CF35AAF898FC1A0D46EA275558420B7C4DB3C312D11C6E51A9BF51FB
HistoryJan 30, 2024 - 3:30 p.m.

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in MiniZip (CVE-2023-45853)

2024-01-3015:30:07
www.ibm.com
16
ibm
infosphere information server
minizip
vulnerability
denial of service
version 11.7

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.8%

JSON

Summary

A denial of service vulnerability in MiniZip that is used by the ODBC drivers included in IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID:CVE-2023-45853
**DESCRIPTION:**MiniZip is vulnerable to a denial of service, caused by an integer overflow and resultant heap-based buffer overflow in the zipOpenNewFileInZip4_64 function. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268650 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
InfoSphere Information Server 11.7

Remediation/Fixes

Product VRMF APAR Remediation
InfoSphere Information Server, InfoSphere Information Server on Cloud 11.7 DT256761
--Upgrade to DataDirect ODBC drivers version 8.0
--Use Technote to choose which OpenSSL version the drivers will use
--Use Technote to follow additional post installation configuration steps

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibminfosphere_information_serverMatch11.7

Related

cve 1
cloudlinux 1
nessus 44
ibm 3
openvas 38
redhatcve 1
ubuntucve 1
cbl_mariner 11
osv 3
alpinelinux 1
cgr 1
gentoo 1
cvelist 1
github 1
veracode 1
debian 1
amazon 1
prion 1
mageia 1
redos 1
nvd 1
debiancve 1
wolfi 1
photon 3
redhat 1
ics 1
cve
cve
CVE-2023-45853
2023-10-14 02:15:09
cloudlinux
cloudlinux
zlib: Fix of CVE-2023-45853
2023-10-24 20:53:31
nessus
nessus
EulerOS Virtualization 2.9.1 : zlib (EulerOS-SA-2024-1051)
2024-01-16 00:00:00
EulerOS Virtualization 2.9.0 : zlib (EulerOS-SA-2024-1025)
2024-01-16 00:00:00
EulerOS Virtualization 2.11.0 : binutils (EulerOS-SA-2024-1424)
2024-03-21 00:00:00
ibm
ibm
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to a denial of service due to MiniZip (CVE-2023-45853)
2024-02-27 15:02:47
Security Bulletin: IBM® Db2® is affected by a vulnerability in the open source zlib library. (CVE-2023-45853)
2024-06-11 17:24:52
Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server
2024-06-18 20:03:13
openvas
openvas
Huawei EulerOS: Security Advisory for zlib (EulerOS-SA-2024-1308)
2024-03-12 00:00:00
Huawei EulerOS: Security Advisory for zlib (EulerOS-SA-2024-1051)
2024-01-05 00:00:00
Huawei EulerOS: Security Advisory for zlib (EulerOS-SA-2024-1394)
2024-03-14 00:00:00
redhatcve
redhatcve
CVE-2023-45853
2023-10-16 23:57:36
ubuntucve
ubuntucve
CVE-2023-45853
2023-10-14 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-45853 affecting package cloud-hypervisor for versions less than 32.0-2
2023-10-31 17:14:33
CVE-2023-45853 affecting package boost for versions less than 1.76.0-4
2023-10-31 17:32:47
CVE-2023-45853 affecting package zlib for versions less than 1.3.1-1
2024-05-17 21:38:35
osv
osv
minizip - security update
2023-11-28 00:00:00
CVE-2023-45853
2023-10-14 02:15:09
pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency
2023-10-14 03:31:16
alpinelinux
alpinelinux
CVE-2023-45853
2023-10-14 02:15:09
cgr
cgr
CVE-2023-45853 vulnerabilities
2024-05-19 03:07:16
gentoo
gentoo
zlib: Buffer Overflow
2024-01-15 00:00:00
cvelist
cvelist
CVE-2023-45853
2023-10-14 00:00:00
github
github
pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency
2023-10-14 03:31:16
veracode
veracode
Buffer Overflow
2023-10-24 02:58:39
debian
debian
[SECURITY] [DLA 3670-1] minizip security update
2023-11-27 23:14:37
amazon
amazon
Medium: zlib
2023-10-30 23:59:00
prion
prion
Integer overflow
2023-10-14 02:15:00
mageia
mageia
Updated zlib packages fix a security vulnerability
2023-11-09 15:55:51
redos
redos
ROS-20231020-01
2023-10-20 00:00:00
nvd
nvd
CVE-2023-45853
2023-10-14 02:15:09
debiancve
debiancve
CVE-2023-45853
2023-10-14 02:15:09
wolfi
wolfi
CVE-2023-45853 vulnerabilities
2024-06-22 09:08:24
photon
photon
Critical Photon OS Security Update - PHSA-2023-3.0-0674
2023-10-26 00:00:00
Critical Photon OS Security Update - PHSA-2023-5.0-0126
2023-10-26 00:00:00
Critical Photon OS Security Update - PHSA-2023-4.0-0497
2023-10-25 00:00:00
redhat
redhat
(RHSA-2023:7626) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
2023-12-07 13:53:17
ics
ics
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
2023-12-14 12:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.8%

JSON
Related for 92457FA7CF35AAF898FC1A0D46EA275558420B7C4DB3C312D11C6E51A9BF51FB
cve1cloudlinux1nessus44ibm3openvas38redhatcve1ubuntucve1cbl_mariner11osv3alpinelinux1cgr1gentoo1cvelist1github1veracode1debian1amazon1prion1mageia1redos1nvd1debiancve1wolfi1photon3redhat1ics1