PT-2023-8864 · Unknown+1 · Minizip-Ng+1

Akane0721 · Published 2023-11-22 · Updated 2025-11-04 · CVE-2023-48107

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions minizip-ng version 4.0.2

Description The issue is related to a Buffer Overflow vulnerability in the mz path has slash() function, located in the mz os.c file, which can be exploited by an attacker using a crafted file. This could allow a remote attacker to execute arbitrary code.

Recommendations For minizip-ng version 4.0.2, consider disabling the mz path has slash() function until a patch is available to prevent potential exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

AZL-43783

BDU:2024-02424

CVE-2023-48107

Affected Products

Red Os

Minizip-Ng

References · 16

• 🔥 https://github.com/zlib-ng/minizip-ng/issues/739 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P3BFGECWPSK5RYDI5GCSW6N2VIXBTUO · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48107 · Security Note
• https://bdu.fstec.ru/vul/2024-02424 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2P3BFGECWPSK5RYDI5GCSW6N2VIXBTUO · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X4BNF4ZDYQZP4JWEY6DBSYKALXQC5QM4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48107 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4BNF4ZDYQZP4JWEY6DBSYKALXQC5QM4 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43783 · Vendor Advisory
• https://github.com/zlib-ng/minizip-ng/issues/740 · Note
• https://t.me/cveNotify/141698 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/65191 · Telegram Post
• https://twitter.com/_msw_/status/1757594726763819123 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-minizip-ng-cve-2023-48107-cve-2023-48106 · Note