Date: Fri, 20 Oct 2023 11:42:10 -0700 From: Alan Coopersmith <alan.coopersmith@...cle.com> To: oss-security@...ts.openwall.com Subject: CVE-2023-45853: overflows in MiniZip in zlib through 1.3 CVE-2023-45853 was published last week for: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. where "long" means "longer than can be stored in the 16-bit length value used for the length of these fields". minizip is part of the contrib directory in zlib, which doesn't seem to be built by default as far as I can tell, yet NVD has assigned a CVSS of 9.8 to make CVE scanners scream at full volume, while Red Hat went with a CVSS of 5.3 instead: https://access.redhat.com/security/cve/CVE-2023-45853#cve-cvss-v3 A fix has been checked into the upstream git repo: https://github.com/madler/zlib/pull/843 but a release has not yet been made including it. -- -Alan Coopersmith- alan.coopersmith@...cle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.