Buffer Overflow Vulnerability in zlib-ng Minizip-ng Affects Multiple Applications
CVE-2023-48106

8.8HIGH

Key Information:

Vendor

Zlib-ng

Status
Minizip-ng
Vendor
CVE Published:
22 November 2023

What is CVE-2023-48106?

A buffer overflow vulnerability has been identified in zlib-ng's minizip-ng version 4.0.2. This security flaw allows an attacker to execute arbitrary code by exploiting a crafted file processed by the mz_path_resolve function located in the mz_os.c file. Applications that utilize affected versions of minizip-ng may be at risk if they process untrusted input, potentially leading to severe security implications.

References

https://github.com/zlib-ng/minizip-ng/issues/740

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.