Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Oct 2023 11:42:10 -0700
From: Alan Coopersmith <>
Subject: CVE-2023-45853: overflows in MiniZip in zlib through 1.3

CVE-2023-45853 was published last week for:

    MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based
    buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or
    extra field. NOTE: MiniZip is not a supported part of the zlib product.

where "long" means "longer than can be stored in the 16-bit length value used
for the length of these fields".

minizip is part of the contrib directory in zlib, which doesn't seem to be built
by default as far as I can tell, yet NVD has assigned a CVSS of 9.8 to make CVE
scanners scream at full volume, while Red Hat went with a CVSS of 5.3 instead:

A fix has been checked into the upstream git repo:
but a release has not yet been made including it.

         -Alan Coopersmith-       
          Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.