CVE-2023-46228

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.suse.com/show_bug.cgi?id=1216268Issue Tracking, Patch, Third Party Advisory
https://github.com/zchunk/zchunk/commit/08aec2b4dfd7f709b6e3d511411ffcc83ed4efbePatch
https://github.com/zchunk/zchunk/compare/1.3.1...1.3.2Patch
https://bugzilla.suse.com/show_bug.cgi?id=1216268Issue Tracking, Patch, Third Party Advisory
https://github.com/zchunk/zchunk/commit/08aec2b4dfd7f709b6e3d511411ffcc83ed4efbePatch
https://github.com/zchunk/zchunk/compare/1.3.1...1.3.2Patch

Timeline

Published: Oct 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-462298.8LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an CVE-2023-46237.8A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve CVE-2023-462304.9In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files.CVE-2023-462317.2In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splun CVE-2023-462325.3era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to CVE-2023-462339.1crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specif CVE-2023-462347.5browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's CVE-2023-462356.1FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request san CVE-2023-462367.5FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (CVE-2023-462375.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer l CVE-2023-462385.4ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including CVE-2023-462397.5quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame