Integer Overflow and Heap Buffer Overflow in MiniZip of zlib Product by zlib

CVE-2023-45853

What is CVE-2023-45853?

The MiniZip component of zlib has been found to have a critical integer overflow and resulting heap-based buffer overflow, triggered by long filenames, comments, or extra fields. This vulnerability can be exploited when using affected versions of zlib, specifically version 1.3 and earlier. Additionally, pyminizip version 0.2.6 is impacted due to its bundling of an affected zlib version, exposing vulnerable MiniZip functionalities through its compress API. Proper mitigation measures should be taken to protect systems that utilize MiniZip in zlib or pyminizip, as these vulnerabilities pose significant risks.

References