PT-2023-8865 · Unknown+1 · Minizip-Ng+1

Akane0721 · Published 2023-11-22 · Updated 2024-03-28 · CVE-2023-48106

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions minizip-ng version 4.0.2

Description The issue is related to a Buffer Overflow in the mz path resolve function, located in the mz os.c file, which can be exploited by an attacker using a crafted file. This could allow a remote attacker to execute arbitrary code. The mz path resolve function is part of the minizip-ng library, used for working with zip files.

Recommendations For minizip-ng version 4.0.2, consider disabling the mz path resolve function until a patch is available to prevent potential exploitation. Restrict access to the mz os.c file and related components to minimize the risk of arbitrary code execution. Avoid using the mz path resolve function with untrusted input until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

AZL-43840

BDU:2024-02425

CVE-2023-48106

Affected Products

Red Os

Minizip-Ng

References · 7

• 🔥 https://github.com/zlib-ng/minizip-ng/issues/740 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48106 · Security Note
• https://osv.dev/vulnerability/AZL-43840 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02425 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48106 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-minizip-ng-cve-2023-48107-cve-2023-48106 · Note