Kritik CVSS 9.8
CVE-2023-45853: Zlib: tamsayı taşması
Açıklama (NVD)
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
Özet bilgiler
- Ürün
- Zlib Zlib
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %3,45 (yüzdelik 89)
- CWE
- CWE-190
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| zlib-zlib | — | — | 1.3.1 |
| smihica-pyminizip | — | 0.2.6 | — |
Kaynaklar
- NVD kaydı
- www.openwall.com
- www.openwall.com
- chromium.googlesource.com
- chromium.googlesource.com
- github.com
- github.com
- lists.debian.org
- pypi.org
- security.gentoo.org
- security.netapp.com
- www.winimage.com
- www.openwall.com
- www.openwall.com
- chromium.googlesource.com
- chromium.googlesource.com
- github.com
- github.com
- lists.debian.org
- pypi.org
- security.gentoo.org
- security.netapp.com
- www.winimage.com
- cert-portal.siemens.com
- cert-portal.siemens.com
- CWE-190