The compression library's first release since 1.3.2 fixes CVE-2026-85091 in non-blocking gzwrite(), an 8 MB overwrite in inflateGetDictionary() and minizip path flaws. It also renames MSVC libraries…

.zip archive handling library extracted from the zlib distribution - andrewwillmott/minizip

Fork of the popular zip manipulation library found in the zlib distribution. - zlib-ng/minizip-ng

v1.9.7 List of changes: 1. Improved download and unzip commands. - Library zzip has been migrated to minizip for improved compatibility (as well as z64 support). - Tested with near 4 GB downlo...

Posted by Alan Coopersmith on Jan 24 The fix was included in this week's zlib 1.3.1 release: https://github.com/madler/zlib/releases/tag/v1.3.1 That release also contains a fix for CVE-2014-9485, a path traversal vulnerability, in the miniunz program from the minizip contrib directory: https://github.com/madler/zlib/commit/14a5f8f266c16c87ab6c086fc52b770b27701e01

Posted by Alan Coopersmith on Oct 20 CVE-2023-45853 was published last week for: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. where "long" means "longer than can be stored in the 16-bit length value used for the length of these fields". minizip is part of the contrib...

It was discovered that Minizip in zlib incorrectly handled certain zip header fields. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.

Hello, I found the minizip call (i.e., equiv. to minizip_erase() function in minizip.c) corrupts an encrypted zip archive. $ unzip -p test_password_abcde.zip > [test_password_abcde.zip] test.txt pa...