AZL-31497
Dashboard / Vulnerabilities / AZL-31497
Summary: CVE-2023-45853 affecting package tcl for versions less than 8.6.13-3
Details: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
References: https://nvd.nist.gov/vuln/detail/CVE-2023-45853
Affected packages
Package
Name: tcl
Purl: pkg:rpm/azure-linux/tcl
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -8.6.13-3
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
