MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade minizipUpgrade qt6-qtwebengineUpgrade zlibUpgrade qt5-qtwebengine | Mar 26, 2024 | Oct 14, 2023 |
| Amazon Linux Ami 2 | — | Upgrade zlib-staticUpgrade zlibUpgrade minizip-develUpgrade zlib-develUpgrade minizipUpgrade zlib-debuginfo | Nov 3, 2023 | Oct 14, 2023 |
| Amazon_linux_2023 | — | Upgrade zlib-debuginfoUpgrade minizip-compat-develUpgrade minizip-compatUpgrade zlibUpgrade zlib-develUpgrade zlib-staticUpgrade minizip-compat-debuginfoUpgrade zlib-debugsource | Feb 17, 2025 | Oct 14, 2023 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 14, 2023 |
| Debian | — | Upgrade minizipUpgrade zlib | Dec 4, 2023 | Oct 14, 2023 |
| Gentoo Linux | — | Upgrade sys-libs/zlib. | Jan 16, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade zlib | Jan 10, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade zlib | Jan 10, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade zlibUpgrade zlib-devel | Feb 12, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade zlib-develUpgrade zlib | Mar 13, 2024 | Oct 14, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade zlib | Jan 10, 2024 | Oct 14, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 14, 2023 |
| Suse | — | Upgrade zlib-testsuiteUpgrade zlib-devel-staticUpgrade libz1-32bitUpgrade libz1Upgrade libminizip1-32bitUpgrade zlib-develUpgrade zlib-devel-static-32bitUpgrade minizip-develUpgrade zlib-devel-32bitUpgrade libminizip1 | Oct 27, 2023 | Oct 14, 2023 |
| Ubuntu | — | Upgrade zlib1g-dev (Ubuntu Pro)Upgrade zlib-bin (Ubuntu Pro)Upgrade zlib1g (Ubuntu Pro)Upgrade libx32z1-dev (Ubuntu Pro)Upgrade libx32z1 (Ubuntu Pro)Upgrade lib32z1 (Ubuntu Pro)Upgrade lib32z1-dev (Ubuntu Pro) | Nov 14, 2024 | Oct 14, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub