Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2023-45853

kritisch

CVE-2023-45853

zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6

Veröffentlicht Geändert CWE 190
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, CBL-Mariner, Julia, Photon OS. Niedriger laut Azure Linux (hoch), Red Hat (mittel), Amazon (mittel), Ubuntu (mittel).

Beschreibung

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
CBL-Mariner 2.0boost, cloud-hypervisor, cloud-hypervisor-cvm und 4 weitere0:1.76.0-4.cm2 und 6 weitere
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jll, Openresty_jll, Zlib_jll1.27.1+0 und 1 weitere
Photon OS 3.0zlib1.2.11-5.ph3
Photon OS 4.0zlib, zlib-devel1.2.11-6.ph4
Photon OS 5.0zlib, zlib-devel1.2.13-2.ph5
pip::GitHub Security Advisory pippyminizipkein Fix angegeben
alpine 3.15zlib0
alpine 3.16zlib0
alpine 3.17zlib0
alpine 3.18minizip, qt5-qtwebengine, zlib1.2.13-r1 und 2 weitere
alpine 3.19minizip, qt5-qtwebengine, qt6-qtwebengine und 1 weitere1.3-r1 und 3 weitere
alpine 3.20minizip, qt5-qtwebengine, qt6-qtwebengine und 1 weitere1.3-r1 und 3 weitere
Alle 104 Einträge aus 36 Quellen zeigen
QuellePaketBehoben in
CBL-Mariner 2.0boost0:1.76.0-4.cm2
CBL-Mariner 2.0cloud-hypervisor0:32.0-2.cm2
CBL-Mariner 2.0cloud-hypervisor-cvm0:38.0.72.2-1.cm2
CBL-Mariner 2.0rubygem-mini_portile20:2.8.0-1.cm2
CBL-Mariner 2.0rust0:1.72.0-5.cm2
CBL-Mariner 2.0tcl0:8.6.13-3.cm2
CBL-Mariner 2.0zlib0:1.2.13-2.cm2
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jllkein Fix angegeben
julia::Julia Ecosystem Security AdvisoriesOpenresty_jll1.27.1+0
julia::Julia Ecosystem Security AdvisoriesZlib_jll1.3.1+0
Photon OS 3.0zlib1.2.11-5.ph3
Photon OS 4.0zlib1.2.11-6.ph4
Photon OS 4.0zlib-devel1.2.11-6.ph4
Photon OS 5.0zlib1.2.13-2.ph5
Photon OS 5.0zlib-devel1.2.13-2.ph5
pip::GitHub Security Advisory pippyminizipkein Fix angegeben
alpine 3.15zlib0
alpine 3.16zlib0
alpine 3.17zlib0
alpine 3.18minizip1.2.13-r1
alpine 3.18qt5-qtwebengine5.15.13-r9
alpine 3.18zlib0
alpine 3.19minizip1.3-r1
alpine 3.19qt5-qtwebengine5.15.15-r4
alpine 3.19qt6-qtwebengine6.6.0-r1
alpine 3.19zlib0
alpine 3.20minizip1.3-r1
alpine 3.20qt5-qtwebengine5.15.15-r4
alpine 3.20qt6-qtwebengine6.6.0-r1
alpine 3.20zlib0
alpine 3.21minizip1.3-r1
alpine 3.21qt5-qtwebengine5.15.15-r4
alpine 3.21qt6-qtwebengine6.6.0-r1
alpine 3.21zlib0
alpine 3.22minizip1.3-r1
alpine 3.22qt5-qtwebengine5.15.15-r4
alpine 3.22qt6-qtwebengine6.6.0-r1
alpine 3.22zlib0
alpine 3.23minizip1.3-r1
alpine 3.23qt5-qtwebengine5.15.15-r4
alpine 3.23qt6-qtwebengine6.6.0-r1
alpine 3.23zlib0
alpine 3.24minizip1.3-r1
alpine 3.24qt6-qtwebengine6.6.0-r1
alpine 3.24zlib0
alpine edgeminizip1.3-r1
alpine edgeqt6-qtwebengine6.6.0-r1
alpine edgezlib0
amazon linux 2minizip1.2.7-19.amzn2.0.3
amazon linux 2minizip-devel1.2.7-19.amzn2.0.3
amazon linux 2zlib1.2.7-19.amzn2.0.3
amazon linux 2zlib-debuginfo1.2.7-19.amzn2.0.3
amazon linux 2zlib-devel1.2.7-19.amzn2.0.3
amazon linux 2zlib-static1.2.7-19.amzn2.0.3
amazon linux 2023minizip-compat1.2.11-33.amzn2023.0.5
amazon linux 2023minizip-compat-debuginfo1.2.11-33.amzn2023.0.5
amazon linux 2023minizip-compat-devel1.2.11-33.amzn2023.0.5
amazon linux 2023zlib1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-debuginfo1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-debugsource1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-devel1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-static1.2.11-33.amzn2023.0.5
Azure Linux 3.0blosc0:1.21.6-1.azl3
Azure Linux 3.0cloud-hypervisor0:32.0-2.azl3
Azure Linux 3.0cloud-hypervisor-cvm0:38.0.72.2-1.azl3
Azure Linux 3.0keras0:3.1.1-1.azl3
Azure Linux 3.0rubygem-mini_portile20:2.8.0-1.azl3
Azure Linux 3.0rust0:1.85.0-1.azl3
Azure Linux 3.0tcl0:8.6.13-3.azl3
Azure Linux 3.0zlib0:1.3.1-1.azl3
chainguardzlib1.3-r1
debian 10minizip1.1-8+deb10u1
debian 10zlibkein Fix angegeben
debian 11minizip1.1-8+deb11u1
debian 11zlibkein Fix angegeben
debian 12minizip1.1-8+deb12u1
debian 12zlibkein Fix angegeben
debian 13zlib1:1.3.dfsg-2
debian 14zlib1:1.3.dfsg-2
echominizip1.1-8+deb12u1
echozlib1:1.2.13.dfsg-1
echozlib-1.1.41.1.4+e1
echozlib-1.2.111.2.11+e1
rapidfort amazon linux 2023minizip-compat1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023minizip-compat-devel1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib-devel1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib-static1.2.11-33.amzn2023.0.5
rapidfort debian 12rf-zlib1:1.3.dfsg-2
rapidfort debian 12zlib1:1.3.dfsg-2
rapidfort debian 13rf-zlib1:1.3.dfsg-2
rapidfort debian 13zlib1:1.3.dfsg-2
Red Hatminizipkein Fix angegeben
Red Hatminizip-develkein Fix angegeben
Red Hatzlibkein Fix angegeben
Red Hatzlib-develkein Fix angegeben
Red Hatzlib-statickein Fix angegeben
root.io debian 11rootio-zlib1:1.2.11.dfsg-2+deb11u2.root.io.1, 1:1.2.11.dfsg-2+deb11u2.root.io.2, 1:1.2.11.dfsg-2+deb11u2.root.io.3, 1:1.2.11.dfsg-2+deb11u2.root.io.4, 1:1.2.11.dfsg-2+deb11u2.root.io.5, 1:1.2.11.dfsg-2+deb11u2.root.io.6, 1:1.2.11.dfsg-2+deb11u2.root.io.7, 1:1.2.11.dfsg-2+deb11u2.root.io.8
root.io debian 11zlib1:1.2.11.dfsg-2+deb11u2.root.io.1, 1:1.2.11.dfsg-2+deb11u2.root.io.2, 1:1.2.11.dfsg-2+deb11u2.root.io.3, 1:1.2.11.dfsg-2+deb11u2.root.io.4, 1:1.2.11.dfsg-2+deb11u2.root.io.5, 1:1.2.11.dfsg-2+deb11u2.root.io.6, 1:1.2.11.dfsg-2+deb11u2.root.io.7, 1:1.2.11.dfsg-2+deb11u2.root.io.8
root.io debian 12rootio-zlib1:1.2.13.dfsg-1.root.io.1, 1:1.2.13.dfsg-1.root.io.2, 1:1.2.13.dfsg-1.root.io.3, 1:1.2.13.dfsg-1.root.io.4
root.io debian 12zlib1:1.2.13.dfsg-1.root.io.1, 1:1.2.13.dfsg-1.root.io.2, 1:1.2.13.dfsg-1.root.io.3, 1:1.2.13.dfsg-1.root.io.4
root.io debian 13rootio-zlib1:1.3.dfsg-2
ubuntu 14.04-ESMzlib1:1.2.8.dfsg-1ubuntu1.1+esm3
wolfizlib1.3-r1

Referenzen

Alle 22 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.