Integer Overflow Vulnerability in zchunk Affecting Multiple Components
CVE-2023-46228

7.8HIGH

Key Information:

Vendor

Zchunk

Status
Zchunk
Vendor
CVE Published:
19 October 2023

What is CVE-2023-46228?

The zchunk tool, prior to version 1.3.2, is prone to multiple integer overflow vulnerabilities caused by the processing of malformed zchunk files. These overflows affect various components, including lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, and lib/header.c. Successful exploitation may lead to data corruption, potentially compromising system integrity.

References

https://github.com/zchunk/zchunk/commit/08aec2b4dfd7f709b...
https://bugzilla.suse.com/show_bug.cgi?id=1216268
https://github.com/zchunk/zchunk/compare/1.3.1...1.3.2

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.