Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2023-45853

crítica

CVE-2023-45853

zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6

Publicada Modificada CWE 190
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, CBL-Mariner, Julia, Photon OS. Más baja según Azure Linux (alta), Red Hat (media), Amazon (media), Ubuntu (media).

Descripción

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
CBL-Mariner 2.0boost, cloud-hypervisor, cloud-hypervisor-cvm y 4 más0:1.76.0-4.cm2 y 6 más
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jll, Openresty_jll, Zlib_jll1.27.1+0 y 1 más
Photon OS 3.0zlib1.2.11-5.ph3
Photon OS 4.0zlib, zlib-devel1.2.11-6.ph4
Photon OS 5.0zlib, zlib-devel1.2.13-2.ph5
pip::GitHub Security Advisory pippyminizipsin corrección indicada
alpine 3.15zlib0
alpine 3.16zlib0
alpine 3.17zlib0
alpine 3.18minizip, qt5-qtwebengine, zlib1.2.13-r1 y 2 más
alpine 3.19minizip, qt5-qtwebengine, qt6-qtwebengine y 1 más1.3-r1 y 3 más
alpine 3.20minizip, qt5-qtwebengine, qt6-qtwebengine y 1 más1.3-r1 y 3 más
Mostrar las 104 entradas de 36 fuentes
FuentePaqueteCorregido en
CBL-Mariner 2.0boost0:1.76.0-4.cm2
CBL-Mariner 2.0cloud-hypervisor0:32.0-2.cm2
CBL-Mariner 2.0cloud-hypervisor-cvm0:38.0.72.2-1.cm2
CBL-Mariner 2.0rubygem-mini_portile20:2.8.0-1.cm2
CBL-Mariner 2.0rust0:1.72.0-5.cm2
CBL-Mariner 2.0tcl0:8.6.13-3.cm2
CBL-Mariner 2.0zlib0:1.2.13-2.cm2
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jllsin corrección indicada
julia::Julia Ecosystem Security AdvisoriesOpenresty_jll1.27.1+0
julia::Julia Ecosystem Security AdvisoriesZlib_jll1.3.1+0
Photon OS 3.0zlib1.2.11-5.ph3
Photon OS 4.0zlib1.2.11-6.ph4
Photon OS 4.0zlib-devel1.2.11-6.ph4
Photon OS 5.0zlib1.2.13-2.ph5
Photon OS 5.0zlib-devel1.2.13-2.ph5
pip::GitHub Security Advisory pippyminizipsin corrección indicada
alpine 3.15zlib0
alpine 3.16zlib0
alpine 3.17zlib0
alpine 3.18minizip1.2.13-r1
alpine 3.18qt5-qtwebengine5.15.13-r9
alpine 3.18zlib0
alpine 3.19minizip1.3-r1
alpine 3.19qt5-qtwebengine5.15.15-r4
alpine 3.19qt6-qtwebengine6.6.0-r1
alpine 3.19zlib0
alpine 3.20minizip1.3-r1
alpine 3.20qt5-qtwebengine5.15.15-r4
alpine 3.20qt6-qtwebengine6.6.0-r1
alpine 3.20zlib0
alpine 3.21minizip1.3-r1
alpine 3.21qt5-qtwebengine5.15.15-r4
alpine 3.21qt6-qtwebengine6.6.0-r1
alpine 3.21zlib0
alpine 3.22minizip1.3-r1
alpine 3.22qt5-qtwebengine5.15.15-r4
alpine 3.22qt6-qtwebengine6.6.0-r1
alpine 3.22zlib0
alpine 3.23minizip1.3-r1
alpine 3.23qt5-qtwebengine5.15.15-r4
alpine 3.23qt6-qtwebengine6.6.0-r1
alpine 3.23zlib0
alpine 3.24minizip1.3-r1
alpine 3.24qt6-qtwebengine6.6.0-r1
alpine 3.24zlib0
alpine edgeminizip1.3-r1
alpine edgeqt6-qtwebengine6.6.0-r1
alpine edgezlib0
amazon linux 2minizip1.2.7-19.amzn2.0.3
amazon linux 2minizip-devel1.2.7-19.amzn2.0.3
amazon linux 2zlib1.2.7-19.amzn2.0.3
amazon linux 2zlib-debuginfo1.2.7-19.amzn2.0.3
amazon linux 2zlib-devel1.2.7-19.amzn2.0.3
amazon linux 2zlib-static1.2.7-19.amzn2.0.3
amazon linux 2023minizip-compat1.2.11-33.amzn2023.0.5
amazon linux 2023minizip-compat-debuginfo1.2.11-33.amzn2023.0.5
amazon linux 2023minizip-compat-devel1.2.11-33.amzn2023.0.5
amazon linux 2023zlib1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-debuginfo1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-debugsource1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-devel1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-static1.2.11-33.amzn2023.0.5
Azure Linux 3.0blosc0:1.21.6-1.azl3
Azure Linux 3.0cloud-hypervisor0:32.0-2.azl3
Azure Linux 3.0cloud-hypervisor-cvm0:38.0.72.2-1.azl3
Azure Linux 3.0keras0:3.1.1-1.azl3
Azure Linux 3.0rubygem-mini_portile20:2.8.0-1.azl3
Azure Linux 3.0rust0:1.85.0-1.azl3
Azure Linux 3.0tcl0:8.6.13-3.azl3
Azure Linux 3.0zlib0:1.3.1-1.azl3
chainguardzlib1.3-r1
debian 10minizip1.1-8+deb10u1
debian 10zlibsin corrección indicada
debian 11minizip1.1-8+deb11u1
debian 11zlibsin corrección indicada
debian 12minizip1.1-8+deb12u1
debian 12zlibsin corrección indicada
debian 13zlib1:1.3.dfsg-2
debian 14zlib1:1.3.dfsg-2
echominizip1.1-8+deb12u1
echozlib1:1.2.13.dfsg-1
echozlib-1.1.41.1.4+e1
echozlib-1.2.111.2.11+e1
rapidfort amazon linux 2023minizip-compat1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023minizip-compat-devel1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib-devel1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib-static1.2.11-33.amzn2023.0.5
rapidfort debian 12rf-zlib1:1.3.dfsg-2
rapidfort debian 12zlib1:1.3.dfsg-2
rapidfort debian 13rf-zlib1:1.3.dfsg-2
rapidfort debian 13zlib1:1.3.dfsg-2
Red Hatminizipsin corrección indicada
Red Hatminizip-develsin corrección indicada
Red Hatzlibsin corrección indicada
Red Hatzlib-develsin corrección indicada
Red Hatzlib-staticsin corrección indicada
root.io debian 11rootio-zlib1:1.2.11.dfsg-2+deb11u2.root.io.1, 1:1.2.11.dfsg-2+deb11u2.root.io.2, 1:1.2.11.dfsg-2+deb11u2.root.io.3, 1:1.2.11.dfsg-2+deb11u2.root.io.4, 1:1.2.11.dfsg-2+deb11u2.root.io.5, 1:1.2.11.dfsg-2+deb11u2.root.io.6, 1:1.2.11.dfsg-2+deb11u2.root.io.7, 1:1.2.11.dfsg-2+deb11u2.root.io.8
root.io debian 11zlib1:1.2.11.dfsg-2+deb11u2.root.io.1, 1:1.2.11.dfsg-2+deb11u2.root.io.2, 1:1.2.11.dfsg-2+deb11u2.root.io.3, 1:1.2.11.dfsg-2+deb11u2.root.io.4, 1:1.2.11.dfsg-2+deb11u2.root.io.5, 1:1.2.11.dfsg-2+deb11u2.root.io.6, 1:1.2.11.dfsg-2+deb11u2.root.io.7, 1:1.2.11.dfsg-2+deb11u2.root.io.8
root.io debian 12rootio-zlib1:1.2.13.dfsg-1.root.io.1, 1:1.2.13.dfsg-1.root.io.2, 1:1.2.13.dfsg-1.root.io.3, 1:1.2.13.dfsg-1.root.io.4
root.io debian 12zlib1:1.2.13.dfsg-1.root.io.1, 1:1.2.13.dfsg-1.root.io.2, 1:1.2.13.dfsg-1.root.io.3, 1:1.2.13.dfsg-1.root.io.4
root.io debian 13rootio-zlib1:1.3.dfsg-2
ubuntu 14.04-ESMzlib1:1.2.8.dfsg-1ubuntu1.1+esm3
wolfizlib1.3-r1

Referencias

Las 22 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.