CVE-2023-45853
Fixed in a distro release EPSS 3%CVSS 8.8
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
Products: zlib, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyminizip | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | minizip | 1.2.7-19.amzn2.0.3 |
| Amazon Linux 2 | minizip-devel | 1.2.7-19.amzn2.0.3 |
| Amazon Linux 2 | zlib | 1.2.7-19.amzn2.0.3 |
| Amazon Linux 2 | zlib-devel | 1.2.7-19.amzn2.0.3 |
| Amazon Linux 2 | zlib-static | 1.2.7-19.amzn2.0.3 |
| Amazon Linux 2023 | minizip-compat | 1.2.11-33.amzn2023.0.5 |
| Amazon Linux 2023 | minizip-compat-devel | 1.2.11-33.amzn2023.0.5 |
| Amazon Linux 2023 | zlib | 1.2.11-33.amzn2023.0.5 |
| Amazon Linux 2023 | zlib-devel | 1.2.11-33.amzn2023.0.5 |
| Amazon Linux 2023 | zlib-static | 1.2.11-33.amzn2023.0.5 |
| Arch Linux | minizip | 1:1.3.1-1 |
| Chainguard | zlib | 1.3-r1 |
| Debian 10 | minizip | 1.1-8+deb10u1 |
| Debian 12 | minizip | 1.1-8+deb12u1 |
| Debian 12 | zlib | no fix |
| Debian 13 | zlib | 1:1.3.dfsg-2 |
| Debian 14 | zlib | 1:1.3.dfsg-2 |
| SUSE Linux Enterprise Micro 5.1 | zlib | 1.2.11-150000.3.48.1 |
| SUSE Linux Enterprise Micro 5.2 | zlib | 1.2.11-150000.3.48.1 |
| SUSE Linux Enterprise Micro 5.3 | zlib | 1.2.11-150000.3.48.1 |
| SUSE Linux Enterprise Micro 5.4 | zlib | 1.2.11-150000.3.48.1 |
| SUSE Linux Enterprise Micro 5.5 | zlib | 1.2.13-150500.4.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | zlib | 1.2.11-150000.3.48.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | zlib | 1.2.13-150500.4.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | zlib | 1.2.11-150000.3.48.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | zlib | 1.2.13-150500.4.3.1 |
| SUSE Linux Enterprise Server 12 SP5 | zlib | 1.2.11-11.37.1 |
| SUSE Linux Enterprise Server 16.0 | zlib | 1.2.13-160000.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | zlib | 1.2.11-11.37.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | zlib | 1.2.13-160000.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | zlib | 1.2.11-11.37.1 |
| SUSE Linux Micro 6.0 | zlib | 1.2.13-7.1 |
| SUSE Linux Micro 6.1 | zlib | 1.2.13-slfo.1.1_2.1 |
| SUSE Linux Micro 6.2 | zlib | 1.2.13-160000.3.1 |
| SUSE Manager Proxy 4.2 | zlib | 1.2.11-150000.3.48.1 |
| SUSE Manager Server 4.2 | zlib | 1.2.11-150000.3.48.1 |
| Ubuntu Pro 14.04 LTS | zlib | 1:1.2.8.dfsg-1ubuntu1.1+esm3 |
| Wolfi | zlib | 1.3-r1 |
| openSUSE Leap 15.4 | zlib | 1.2.11-150000.3.48.1 |
| openSUSE Leap 15.5 | zlib | 1.2.13-150500.4.3.1 |
| openSUSE Leap 16.0 | zlib | 1.2.13-160000.3.1 |
| openSUSE Leap Micro 5.3 | zlib | 1.2.11-150000.3.48.1 |
| openSUSE Leap Micro 5.4 | zlib | 1.2.11-150000.3.48.1 |
| openSUSE Tumbleweed | grype | 0.88.0-1.1 |