Detections
Analytics
Alpine: zlib: security update to 0
critical Tenable Self-Hosted Container Security Plugin ID 407964
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the
deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and
heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted
malicious file potentially leading to denial of service of the software. Patches: The issue has been
patched in commit 8352d10
https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream
repository is not affected. (CVE-2023-6992)
- MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in
zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported
part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected
zlib version, and exposes the applicable MiniZip code through its compress API. (CVE-2023-45853)
See Also
Plugin Details
Severity: Critical
ID: 407964
Version: Revision 1.36
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.75
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-45853
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/14/2023
Reference Information
CVE: CVE-2023-45853, CVE-2023-6992