Critical severity9.8NVD Advisory· Published Oct 14, 2023· Updated Jul 14, 2026
CVE-2023-45853
CVE-2023-45853
Description
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pyminizipPyPI | <= 0.2.6 | — |
Affected products
39- zlib/MiniZipdescription
- osv-coords36 versionspkg:apk/wolfi/zlib-devpkg:pypi/pyminizippkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/opensuse/zlib&distro=openSUSE%20Leap%20Micro%205.4pkg:apk/chainguard/minizippkg:apk/chainguard/zlibpkg:apk/chainguard/zlib-devpkg:apk/chainguard/zlib-docpkg:apk/chainguard/zlib-staticpkg:apk/wolfi/minizippkg:apk/wolfi/zlibpkg:apk/wolfi/zlib-docpkg:apk/wolfi/zlib-staticpkg:rpm/opensuse/zlib&distro=openSUSE%20Leap%2016.0pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/zlib&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Micro%206.2pkg:rpm/opensuse/grype&distro=openSUSE%20Tumbleweedpkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/opensuse/zlib&distro=openSUSE%20Leap%20Micro%205.3pkg:rpm/opensuse/zlib&distro=openSUSE%20Leap%2015.4pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5pkg:rpm/opensuse/zlib&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/zlib&distro=SUSE%20Manager%20Proxy%204.2pkg:rpm/suse/zlib&distro=SUSE%20Linux%20Enterprise%20Micro%205.2
< 1.3-r1+ 35 more
- (no CPE)range: < 1.3-r1
- (no CPE)range: <= 0.2.6
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.3-r1
- (no CPE)range: < 1.2.13-160000.3.1
- (no CPE)range: < 1.2.11-11.37.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.13-160000.3.1
- (no CPE)range: < 1.2.13-160000.3.1
- (no CPE)range: < 1.2.13-slfo.1.1_2.1
- (no CPE)range: < 1.2.13-7.1
- (no CPE)range: < 1.2.13-160000.3.1
- (no CPE)range: < 0.88.0-1.1
- (no CPE)range: < 1.2.11-11.37.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.13-150500.4.3.1
- (no CPE)range: < 1.2.13-150500.4.3.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.13-150500.4.3.1
- (no CPE)range: < 1.2.13-150500.4.3.1
- (no CPE)range: < 1.2.11-11.37.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.11-150000.3.48.1
- (no CPE)range: < 1.2.11-150000.3.48.1
Patches
Vulnerability mechanics
References
19- chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356nvdMailing ListPatchWEB
- chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61nvdMailing ListPatchWEB
- github.com/madler/zlib/pull/843nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-mq29-j5xf-cjwrghsaADVISORY
- lists.debian.org/debian-lts-announce/2023/11/msg00026.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-45853ghsaADVISORY
- security.gentoo.org/glsa/202401-18nvdThird Party AdvisoryWEB
- security.netapp.com/advisory/ntap-20231130-0009/nvdThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/20/9nvdMailing ListWEB
- www.openwall.com/lists/oss-security/2024/01/24/10nvdMailing ListWEB
- github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contribnvdProductWEB
- github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10cghsaWEB
- github.com/smihica/pyminizip/blob/master/zlib-1.2.11/contrib/minizip/zip.cghsaWEB
- pypi.org/project/pyminizip/nvdRelease NotesWEB
- security.netapp.com/advisory/ntap-20231130-0009ghsaWEB
- www.winimage.com/zLibDll/minizip.htmlnvdProductWEB
- cert-portal.siemens.com/productcert/html/ssa-398330.htmlnvd
- cert-portal.siemens.com/productcert/html/ssa-470355.htmlnvd
- cert-portal.siemens.com/productcert/html/ssa-769027.htmlnvd
News mentions
1- Siemens CADRACISA ICS Advisories