Closed mswilson closed 7 months ago
Test case .zip file from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774321 attached: traversal.zip
Second test case .zip file from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776831 attached: traversal2.zip
Zlib 1.3.1 has been released (2024-01-22):
When I was investigating publicly known vulnerabilities in #868 I discovered that Debian patched their copy of minizip (which is compiled from the zlib source distribution) to neutralize some traversal attacks. The original CVE allocated for this issue was CVE-2014-9485, and the current patch that Debian carries downstream is here: https://sources.debian.org/patches/zlib/1:1.3.dfsg-3/CVE-2014-9485-miniunzip.patch/