CVE Feed

    Dashboard / CVE / CVE-2023-45853

    CVE-2023-45853

    MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

    Published:Oct 14, 2023
    Last Modified:Jul 14, 2026
    EPS:Oct 14, 2023
    EPSS Score:0.02918
    CVSS Score:8.8

    Affected Products

    Vendor
    Redhat
    Product
    Jboss Core Services
    Vendor
    Smihica
    Product
    Pyminizip
    Vendor
    Zlib
    Product
    Zlib

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-6732 (CVSS 6.5) — A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Sche…
    CVE-2026-3234 (CVSS 4.3) — A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in th…
    CVE-2026-1757 (CVSS 6.2) — A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memo…
    CVE-2026-0992 (CVSS 2.9) — A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when proc…
    CVE-2026-0990 (CVSS 5.9) — A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the x…
    CVE-2026-0989 (CVSS 3.7) — A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. …
    CVE-2025-6170 (CVSS 2.5) — A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a…
    CVE-2025-6021 (CVSS 7.5) — A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can …
    CVE-2025-49795 (CVSS 7.5) — A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw…
    CVE-2025-49796 (CVSS 9.1) — A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger…

    References

    http://www.openwall.com/lists/oss-security/2023/10/20/9
    http://www.openwall.com/lists/oss-security/2024/01/24/10
    https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356
    https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61
    https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4
    https://github.com/madler/zlib/pull/843
    https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html
    https://pypi.org/project/pyminizip/#history
    https://security.gentoo.org/glsa/202401-18
    https://security.netapp.com/advisory/ntap-20231130-0009/
    https://www.winimage.com/zLibDll/minizip.html
    http://www.openwall.com/lists/oss-security/2023/10/20/9
    http://www.openwall.com/lists/oss-security/2024/01/24/10
    https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356
    https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61
    https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4
    https://github.com/madler/zlib/pull/843
    https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html
    https://pypi.org/project/pyminizip/#history
    https://security.gentoo.org/glsa/202401-18
    https://security.netapp.com/advisory/ntap-20231130-0009/
    https://www.winimage.com/zLibDll/minizip.html
    https://cert-portal.siemens.com/productcert/html/ssa-398330.html
    https://cert-portal.siemens.com/productcert/html/ssa-470355.html
    https://cert-portal.siemens.com/productcert/html/ssa-769027.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High