Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2023-45853

critique

CVE-2023-45853

zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6

Publiée Modifiée CWE 190
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, CBL-Mariner, Julia, Photon OS. Plus basse selon Azure Linux (élevée), Red Hat (moyenne), Amazon (moyenne), Ubuntu (moyenne).

Description

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
CBL-Mariner 2.0boost, cloud-hypervisor, cloud-hypervisor-cvm et 4 autres0:1.76.0-4.cm2 et 6 autres
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jll, Openresty_jll, Zlib_jll1.27.1+0 et 1 autres
Photon OS 3.0zlib1.2.11-5.ph3
Photon OS 4.0zlib, zlib-devel1.2.11-6.ph4
Photon OS 5.0zlib, zlib-devel1.2.13-2.ph5
pip::GitHub Security Advisory pippyminizippas de correctif indiqué
alpine 3.15zlib0
alpine 3.16zlib0
alpine 3.17zlib0
alpine 3.18minizip, qt5-qtwebengine, zlib1.2.13-r1 et 2 autres
alpine 3.19minizip, qt5-qtwebengine, qt6-qtwebengine et 1 autres1.3-r1 et 3 autres
alpine 3.20minizip, qt5-qtwebengine, qt6-qtwebengine et 1 autres1.3-r1 et 3 autres
Afficher les 104 entrées de 36 sources
SourcePaquetCorrigé en
CBL-Mariner 2.0boost0:1.76.0-4.cm2
CBL-Mariner 2.0cloud-hypervisor0:32.0-2.cm2
CBL-Mariner 2.0cloud-hypervisor-cvm0:38.0.72.2-1.cm2
CBL-Mariner 2.0rubygem-mini_portile20:2.8.0-1.cm2
CBL-Mariner 2.0rust0:1.72.0-5.cm2
CBL-Mariner 2.0tcl0:8.6.13-3.cm2
CBL-Mariner 2.0zlib0:1.2.13-2.cm2
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jllpas de correctif indiqué
julia::Julia Ecosystem Security AdvisoriesOpenresty_jll1.27.1+0
julia::Julia Ecosystem Security AdvisoriesZlib_jll1.3.1+0
Photon OS 3.0zlib1.2.11-5.ph3
Photon OS 4.0zlib1.2.11-6.ph4
Photon OS 4.0zlib-devel1.2.11-6.ph4
Photon OS 5.0zlib1.2.13-2.ph5
Photon OS 5.0zlib-devel1.2.13-2.ph5
pip::GitHub Security Advisory pippyminizippas de correctif indiqué
alpine 3.15zlib0
alpine 3.16zlib0
alpine 3.17zlib0
alpine 3.18minizip1.2.13-r1
alpine 3.18qt5-qtwebengine5.15.13-r9
alpine 3.18zlib0
alpine 3.19minizip1.3-r1
alpine 3.19qt5-qtwebengine5.15.15-r4
alpine 3.19qt6-qtwebengine6.6.0-r1
alpine 3.19zlib0
alpine 3.20minizip1.3-r1
alpine 3.20qt5-qtwebengine5.15.15-r4
alpine 3.20qt6-qtwebengine6.6.0-r1
alpine 3.20zlib0
alpine 3.21minizip1.3-r1
alpine 3.21qt5-qtwebengine5.15.15-r4
alpine 3.21qt6-qtwebengine6.6.0-r1
alpine 3.21zlib0
alpine 3.22minizip1.3-r1
alpine 3.22qt5-qtwebengine5.15.15-r4
alpine 3.22qt6-qtwebengine6.6.0-r1
alpine 3.22zlib0
alpine 3.23minizip1.3-r1
alpine 3.23qt5-qtwebengine5.15.15-r4
alpine 3.23qt6-qtwebengine6.6.0-r1
alpine 3.23zlib0
alpine 3.24minizip1.3-r1
alpine 3.24qt6-qtwebengine6.6.0-r1
alpine 3.24zlib0
alpine edgeminizip1.3-r1
alpine edgeqt6-qtwebengine6.6.0-r1
alpine edgezlib0
amazon linux 2minizip1.2.7-19.amzn2.0.3
amazon linux 2minizip-devel1.2.7-19.amzn2.0.3
amazon linux 2zlib1.2.7-19.amzn2.0.3
amazon linux 2zlib-debuginfo1.2.7-19.amzn2.0.3
amazon linux 2zlib-devel1.2.7-19.amzn2.0.3
amazon linux 2zlib-static1.2.7-19.amzn2.0.3
amazon linux 2023minizip-compat1.2.11-33.amzn2023.0.5
amazon linux 2023minizip-compat-debuginfo1.2.11-33.amzn2023.0.5
amazon linux 2023minizip-compat-devel1.2.11-33.amzn2023.0.5
amazon linux 2023zlib1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-debuginfo1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-debugsource1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-devel1.2.11-33.amzn2023.0.5
amazon linux 2023zlib-static1.2.11-33.amzn2023.0.5
Azure Linux 3.0blosc0:1.21.6-1.azl3
Azure Linux 3.0cloud-hypervisor0:32.0-2.azl3
Azure Linux 3.0cloud-hypervisor-cvm0:38.0.72.2-1.azl3
Azure Linux 3.0keras0:3.1.1-1.azl3
Azure Linux 3.0rubygem-mini_portile20:2.8.0-1.azl3
Azure Linux 3.0rust0:1.85.0-1.azl3
Azure Linux 3.0tcl0:8.6.13-3.azl3
Azure Linux 3.0zlib0:1.3.1-1.azl3
chainguardzlib1.3-r1
debian 10minizip1.1-8+deb10u1
debian 10zlibpas de correctif indiqué
debian 11minizip1.1-8+deb11u1
debian 11zlibpas de correctif indiqué
debian 12minizip1.1-8+deb12u1
debian 12zlibpas de correctif indiqué
debian 13zlib1:1.3.dfsg-2
debian 14zlib1:1.3.dfsg-2
echominizip1.1-8+deb12u1
echozlib1:1.2.13.dfsg-1
echozlib-1.1.41.1.4+e1
echozlib-1.2.111.2.11+e1
rapidfort amazon linux 2023minizip-compat1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023minizip-compat-devel1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib-devel1.2.11-33.amzn2023.0.5
rapidfort amazon linux 2023zlib-static1.2.11-33.amzn2023.0.5
rapidfort debian 12rf-zlib1:1.3.dfsg-2
rapidfort debian 12zlib1:1.3.dfsg-2
rapidfort debian 13rf-zlib1:1.3.dfsg-2
rapidfort debian 13zlib1:1.3.dfsg-2
Red Hatminizippas de correctif indiqué
Red Hatminizip-develpas de correctif indiqué
Red Hatzlibpas de correctif indiqué
Red Hatzlib-develpas de correctif indiqué
Red Hatzlib-staticpas de correctif indiqué
root.io debian 11rootio-zlib1:1.2.11.dfsg-2+deb11u2.root.io.1, 1:1.2.11.dfsg-2+deb11u2.root.io.2, 1:1.2.11.dfsg-2+deb11u2.root.io.3, 1:1.2.11.dfsg-2+deb11u2.root.io.4, 1:1.2.11.dfsg-2+deb11u2.root.io.5, 1:1.2.11.dfsg-2+deb11u2.root.io.6, 1:1.2.11.dfsg-2+deb11u2.root.io.7, 1:1.2.11.dfsg-2+deb11u2.root.io.8
root.io debian 11zlib1:1.2.11.dfsg-2+deb11u2.root.io.1, 1:1.2.11.dfsg-2+deb11u2.root.io.2, 1:1.2.11.dfsg-2+deb11u2.root.io.3, 1:1.2.11.dfsg-2+deb11u2.root.io.4, 1:1.2.11.dfsg-2+deb11u2.root.io.5, 1:1.2.11.dfsg-2+deb11u2.root.io.6, 1:1.2.11.dfsg-2+deb11u2.root.io.7, 1:1.2.11.dfsg-2+deb11u2.root.io.8
root.io debian 12rootio-zlib1:1.2.13.dfsg-1.root.io.1, 1:1.2.13.dfsg-1.root.io.2, 1:1.2.13.dfsg-1.root.io.3, 1:1.2.13.dfsg-1.root.io.4
root.io debian 12zlib1:1.2.13.dfsg-1.root.io.1, 1:1.2.13.dfsg-1.root.io.2, 1:1.2.13.dfsg-1.root.io.3, 1:1.2.13.dfsg-1.root.io.4
root.io debian 13rootio-zlib1:1.3.dfsg-2
ubuntu 14.04-ESMzlib1:1.2.8.dfsg-1ubuntu1.1+esm3
wolfizlib1.3-r1

Références

Les 22 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.