7-zip p7zip vulnerabilities and exploits

(subscribe to this query)

5

CVSSv2

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applicat...

7-zip P7zip 16.02

1 Github repository

NA

p7zip 16.02 exists to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp.

7-zip P7zip 16.02

6.8

CVSSv2

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip prior to 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote malicious users to cause a denial of service (segmentation fault) or execute arbitrary code...

7-zip 7-zip 7-zip P7zip Debian Debian Linux 7.0 Debian Debian Linux 9.0 Debian Debian Linux 8.0

6.8

CVSSv2

Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip prior to 18.00 and p7zip allows remote malicious users to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.

7-zip 7-zip 7-zip P7zip Debian Debian Linux 9.0 Debian Debian Linux 8.0 Debian Debian Linux 7.0

6.8

CVSSv2

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote malicious users to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.

Opensuse Opensuse 13.2 Debian Debian Linux 8.0 Debian Debian Linux 9.0 7-zip 7-zip 9.20 7-zip 7-zip 15.05

1 Github repository

5.8

CVSSv2

p7zip 9.20.1 allows remote malicious users to write to arbitrary files via a symlink attack in an archive.

Fedoraproject Fedora 22 Fedoraproject Fedora 23 Oracle Solaris 10.0 Oracle Solaris 11.2 7-zip P7zip 9.20.1

6.8

CVSSv2

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote malicious users to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

7-zip 7-zip

1 Github repository

9.3

CVSSv2

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip prior to 16.00 and p7zip allows remote malicious users to execute arbitrary code via a crafted HFS+ image.

7-zip 7-zip Fedoraproject Fedora 24 Fedoraproject Fedora 23 Oracle Solaris

2 Github repositories

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook