CLSA-2023-1698180079 zlib: Fix of CVE-2023-45853

CVE-2023-45853: Reject overflows of zip header fields in minizip...

CLSA-2023-1698179874 zlib: Fix of CVE-2023-45853

CVE-2023-45853: Reject overflows of zip header fields in minizip...

OESA-2023-1751 zlib security update

Zlib is a free, general-purpose, not covered by any patents, lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Security Fixes: MiniZip in zlib through 1.3 has an integer overflow and resulta...

ROS-20231020-01

A vulnerability in the MiniZip component of the zlib library is related to an integer overflow and resulting heap-based buffer overflow in zipOpenNewFileInZip464 via long filename, comment or additional field. Exploitation of the vulnerability could allow an attacker acting remotely to cause a...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.10057)

The version of AHV installed on the remote host is prior to 20220304.10057. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20220304.10057 advisory. - An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes...

CVE-2023-45853

A flaw was found in the MiniZip component of the zlib package. When opening a new file, MiniZip doesn't properly validate the filename, comments, or extra fields length against the data type used to store this information. This may allow an attacker to craft a malicious ZIP file that will lead to...

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename comment or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version and exposes the applicable MiniZip code through its compress API.

...

GHSA-MQ29-J5XF-CJWR vulnerabilities

Vulnerabilities for packages: zlib...

pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. pyminizip uses version 1.2.11 of zlib's code...

GHSA-MQ29-J5XF-CJWR vulnerabilities

Vulnerabilities for packages: zlib...

GHSA-MQ29-J5XF-CJWR pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. pyminizip uses version 1.2.11 of zlib's code...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the MiniZip function in zlib, by providing a long filename, comment, or extra field. Remediation Upgrade zlib to version 1.3.1 or higher. References - GitHub Commit - GitHub PR - Vulnerable Code...

AZL-61279 CVE-2023-45853 affecting package rust for versions less than 1.85.0-1

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-43522 CVE-2023-45853 affecting package deltarpm 3.6.2-7

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-35242 CVE-2023-45853 affecting package rust for versions less than 1.75.0-1

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-34597 CVE-2023-45853 affecting package cloud-hypervisor for versions less than 32.0-2

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-35295 CVE-2023-45853 affecting package tcl for versions less than 8.6.13-3

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

CVE-2023-45853

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-31294 CVE-2023-45853 affecting package boost for versions less than 1.76.0-4

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

AZL-35229 CVE-2023-45853 affecting package rubygem-mini_portile2 for versions less than 2.8.0-1

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...