MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qt5-qtwebengineUpgrade zlibUpgrade minizipUpgrade qt6-qtwebengine | Mar 26, 2024 | Oct 14, 2023 |
| Amazon Linux Ami 2 | — | Upgrade minizipUpgrade zlib-debuginfoUpgrade zlibUpgrade zlib-staticUpgrade minizip-develUpgrade zlib-devel | Nov 3, 2023 | Oct 14, 2023 |
| Amazon_linux_2023 | — | Upgrade minizip-compatUpgrade zlib-debuginfoUpgrade zlib-develUpgrade minizip-compat-develUpgrade zlibUpgrade zlib-staticUpgrade zlib-debugsourceUpgrade minizip-compat-debuginfo | Feb 17, 2025 | Oct 14, 2023 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 14, 2023 |
| Debian | — | Upgrade zlibUpgrade minizip | Dec 4, 2023 | Oct 14, 2023 |
| Gentoo Linux | — | Upgrade sys-libs/zlib. | Jan 16, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade zlib | Jan 10, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade zlib | Jan 10, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade zlib-develUpgrade zlib | Feb 12, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade zlibUpgrade zlib-devel | Mar 13, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade zlib | Jan 10, 2024 | Oct 14, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 14, 2023 |
| Suse | — | Upgrade zlib-devel-static-32bitUpgrade zlib-develUpgrade minizip-develUpgrade zlib-devel-32bitUpgrade libminizip1Upgrade libz1-32bitUpgrade libminizip1-32bitUpgrade libz1Upgrade zlib-devel-staticUpgrade zlib-testsuite | Oct 27, 2023 | Oct 14, 2023 |
| Ubuntu | — | Upgrade lib32z1 (Ubuntu Pro)Upgrade libx32z1 (Ubuntu Pro)Upgrade lib32z1-dev (Ubuntu Pro)Upgrade libx32z1-dev (Ubuntu Pro)Upgrade zlib1g (Ubuntu Pro)Upgrade zlib1g-dev (Ubuntu Pro)Upgrade zlib-bin (Ubuntu Pro) | Nov 14, 2024 | Oct 14, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub