MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename comment or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version and exposes the applicable MiniZip code through its compress API.

🗓️ 16 Oct 2023 07:00:00Reported by MicrosoftType

Zlib MiniZip up to 1.3 has integer and heap overflow in zipOpenNewFileInZip4_64 from long names; pyminizip up to 0.2.6 affected.

Reporter	Title	Published	Views	Family All 246
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	6 May 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: Oracle Outside In Technology (OIT) Security Vulnerabilities - July 2024	5 Mar 202517:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® is affected by a vulnerability in the open source zlib library. (CVE-2023-45853)	11 Jun 202417:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® Db2® affect IBM® Db2® Big SQL.	25 Jan 202611:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager	10 Jul 202407:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in MiniZip (CVE-2023-45853)	30 Jan 202415:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Omnifind Text Search Server for DB2 for i is affected by multiple vulnerabilities[CVE-2017-12626,CVE-2023-44483,CVE-2023-45853,CVE-2024-8176,CVE-2024-11612,CVE-2024-50602,CVE-2025-27363,CVE-2025-29482,CVE-2025-48924,CVE-2025-53816]	20 Jun 202601:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in DB2 JDBC driver shipped with IBM Tivoli Business Service Manager	5 Feb 202500:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 and IBM WebSphere Application Server traditional used by IBM Security Verify Governance have multiple vulnerabilities	10 Jul 202416:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Db2 affect Cloud Pak System	28 Oct 202416:03	–	ibm