Skip to content
OpenAdvisories
Medium ALAS2023-2023-410 1 CVE

Moderate: zlib security update (Amazon Linux 2023)

Published Oct 30, 2023 · Updated Nov 3, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45853: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 minizip-compat 0:1.2.11-33.amzn2023.0.5
Amazon Linux · 2023 minizip-compat-debuginfo 0:1.2.11-33.amzn2023.0.5
Amazon Linux · 2023 minizip-compat-devel 0:1.2.11-33.amzn2023.0.5
Amazon Linux · 2023 zlib 0:1.2.11-33.amzn2023.0.5
Amazon Linux · 2023 zlib-debuginfo 0:1.2.11-33.amzn2023.0.5
Amazon Linux · 2023 zlib-debugsource 0:1.2.11-33.amzn2023.0.5
Amazon Linux · 2023 zlib-devel 0:1.2.11-33.amzn2023.0.5
Amazon Linux · 2023 zlib-static 0:1.2.11-33.amzn2023.0.5

Vulnerabilities 1

  • High 8.8
    CVE-2023-45853

    pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

    MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is a…

    qt6-qtwebengine qt5-qtwebengine rust cloud-hypervisor Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-45853.html