PT-2023-8864 · Unknown+1 · Minizip-Ng+1

Akane0721 · Publicado 2023-11-22 · Atualizado 2025-11-04 · CVE-2023-48107

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions minizip-ng version 4.0.2

Description The issue is related to a Buffer Overflow vulnerability in the mz path has slash() function, located in the mz os.c file, which can be exploited by an attacker using a crafted file. This could allow a remote attacker to execute arbitrary code.

Recommendations For minizip-ng version 4.0.2, consider disabling the mz path has slash() function until a patch is available to prevent potential exploitation.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

AZL-43783

BDU:2024-02424

CVE-2023-48107

Produtos afetados

Red Os

Minizip-Ng

Referências · 16

• 🔥 https://github.com/zlib-ng/minizip-ng/issues/739 · Exploit
• https://github.com/zlib-ng/minizip-ng/issues/740 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P3BFGECWPSK5RYDI5GCSW6N2VIXBTUO · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-48107 · Nota de Segurança
• https://t.me/cveNotify/141698 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-02424 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2P3BFGECWPSK5RYDI5GCSW6N2VIXBTUO · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X4BNF4ZDYQZP4JWEY6DBSYKALXQC5QM4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-48107 · Aviso do Fabricante
• https://t.me/cvenotify/65191 · Publicação no Telegram
• https://twitter.com/_msw_/status/1757594726763819123 · Publicação no Twitter
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4BNF4ZDYQZP4JWEY6DBSYKALXQC5QM4 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-minizip-ng-cve-2023-48107-cve-2023-48106 · Nota
• https://osv.dev/vulnerability/AZL-43783 · Aviso do Fabricante