Bug 918432 (CVE-2023-46228)

Summary:	<app-arch/zchunk-1.3.2: multiple integer overflow vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	kangie, proxy-maint
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~3 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-11-24 21:13:44 UTC

CVE-2023-46228 (https://github.com/zchunk/zchunk/commit/08aec2b4dfd7f709b6e3d511411ffcc83ed4efbe):

zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c.

Please bump to 1.3.2.

Comment 1 Hans de Graaff gentoo-dev

2024-05-05 08:23:24 UTC

No vulnerable versions left and the package never had a stable version, so we are all done here.