CVE catalog

CVE-2023-46228

zchunk: CVE-2023-46228

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.28% · Oct 25, 2026

zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzchunksid1.5.3+ds1-2fixed
Debianzchunkforky1.5.3+ds1-2fixed
Debianzchunktrixie1.5.1+ds1-1fixed
Debianzchunkbookworm1.2.3+ds1-2vulnerable
Ubuntuzchunk22.041.1.9+ds1-1vulnerable
Ubuntuzchunk22.041.1.16+ds1-1vulnerable
Ubuntuzchunk24.041.3.1+ds1-1vulnerable
Ubuntuzchunk24.041.3.2+ds1-1vulnerable
Ubuntuzchunk24.041.3.2+ds1-1build1vulnerable
Ubuntuzchunk24.041.3.2+ds1-1build2vulnerable
Susezchunklinux enterprise installer updates 15 sp41.1.16-150400.3.7.1fixed
Susezchunklinux enterprise micro 5.31.1.16-150400.3.7.1fixed
Susezchunklinux enterprise micro 5.41.1.16-150400.3.7.1fixed
Susezchunklinux enterprise micro 5.51.1.16-150400.3.7.1fixed
Susezchunklinux enterprise module for basesystem 15 sp41.1.16-150400.3.7.1fixed
Susezchunklinux enterprise module for basesystem 15 sp51.1.16-150400.3.7.1fixed
Susezchunklinux enterprise module for package hub 15 sp51.1.16-150400.3.7.1fixed
Opensusezchunkleap micro 5.31.1.16-150400.3.7.1fixed
Opensusezchunkleap micro 5.41.1.16-150400.3.7.1fixed
Opensusezchunkleap 15.41.1.16-150400.3.7.1fixed
Opensusezchunkleap 15.51.1.16-150400.3.7.1fixed
Susezchunklinux enterprise micro 5.51.1.16-150400.3.7.1fixed
Susezchunklinux enterprise high performance computing 15 sp2-ltss1.1.5-150200.3.5.1fixed
Susezchunklinux enterprise high performance computing 15 sp3-espos1.1.5-150200.3.5.1fixed
Susezchunklinux enterprise high performance computing 15 sp3-ltss1.1.5-150200.3.5.1fixed
Susezchunklinux enterprise server 15 sp2-ltss1.1.5-150200.3.5.1fixed
Susezchunklinux enterprise server 15 sp3-ltss1.1.5-150200.3.5.1fixed
Susezchunklinux enterprise server for sap applications 15 sp21.1.5-150200.3.5.1fixed
Susezchunklinux enterprise server for sap applications 15 sp31.1.5-150200.3.5.1fixed
Susezchunkmanager proxy 4.21.1.5-150200.3.5.1fixed
Susezchunkmanager server 4.21.1.5-150200.3.5.1fixed
Susezchunkenterprise storage 7.11.1.5-150200.3.5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzchunksourcesid1.3.2+ds1-1not yet assignedNot reported[1054235]
Debianzchunksourceforky1.3.2+ds1-1not yet assignedNot reported[1054235]
Debianzchunksourcetrixie1.3.2+ds1-1not yet assignedNot reported[1054235]
Debianzchunksourcebookworm(unfixed)not yet assignedNot reported[1054235]
Susezchunkrpmlinux enterprise installer updates 15 sp41.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Susezchunkrpmlinux enterprise micro 5.31.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Susezchunkrpmlinux enterprise micro 5.41.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Susezchunkrpmlinux enterprise micro 5.51.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Susezchunkrpmlinux enterprise module for basesystem 15 sp41.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Susezchunkrpmlinux enterprise module for basesystem 15 sp51.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Susezchunkrpmlinux enterprise module for package hub 15 sp51.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Opensusezchunkrpmleap micro 5.31.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Opensusezchunkrpmleap micro 5.41.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Opensusezchunkrpmleap 15.41.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Opensusezchunkrpmleap 15.51.1.16-150400.3.7.1Not reportedSUSE-SU-2023:4225-1Not reported
Susezchunkrpmlinux enterprise micro 5.51.1.16-150400.3.7.1Not reportedSUSE-SU-2024:2432-1Not reported
Susezchunkrpmlinux enterprise high performance computing 15 sp2-ltss1.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmlinux enterprise high performance computing 15 sp3-espos1.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmlinux enterprise high performance computing 15 sp3-ltss1.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmlinux enterprise server 15 sp2-ltss1.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmlinux enterprise server 15 sp3-ltss1.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmlinux enterprise server for sap applications 15 sp21.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmlinux enterprise server for sap applications 15 sp31.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmmanager proxy 4.21.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmmanager server 4.21.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported
Susezchunkrpmenterprise storage 7.11.1.5-150200.3.5.1Not reportedSUSE-SU-2023:4224-1Not reported

[Debian bug #1054235]

Notes

[bookworm] zchunk: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]