MITRE reports :

Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.

The p7zip package has a heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip which allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.

For Debian 7 'Wheezy', these problems have been fixed in version 9.20.1~dfsg.1-4+deb7u3.

We recommend that you upgrade your p7zip packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Improve security patch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

'landave' discovered a heap-based buffer overflow vulnerability in the NCompress::NShrink::CDecoder::CodeReal method in p7zip, a 7zr file archiver with high compression ratio. A remote attacker can take advantage of this flaw to cause a denial-of-service or, potentially the execution of arbitrary code with the privileges of the user running p7zip, if a specially crafted shrinked ZIP archive is processed.

Improved security patch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for p7zip fixes the following security issues :

  - CVE-2016-1372: Fixed multiple vulnerabilities when     processing crafted 7z files (bsc#984650)

  - CVE-2017-17969: Fixed a heap-based buffer overflow in a     shrink decoder (bsc#1077725)

  - CVE-2018-5996: Fixed memory corruption in RAR     decompression. The complete RAR decoder was removed as     it also has license issues (bsc#1077724 bsc#1077978)

This update was imported from the SUSE:SLE-12:Update update project.

The version of 7-Zip installed on the remote Windows host is prior to 18.0. It is, therefore, affected by multiple vulnerabilities.

It was discovered that p7zip did not correctly handle certain malformed archives. If a user or automated system were tricked into processing a specially crafted archive with p7zip, then p7zip could be made to crash, possibly leading to arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-17969 (from Debian)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for p7zip fixes the following issues: Security issues fixed :

  - CVE-2016-1372: Fixed multiple vulnerabilities when     processing crafted 7z files (bsc#984650)

  - CVE-2017-17969: Fixed a heap-based buffer overflow in a     shrink decoder (bsc#1077725)

  - CVE-2018-5996: Fixed memory corruption in RAR     decompression. The complete RAR decoder was removed as     it also has license issues (bsc#1077724 bsc#1077978)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
106735	FreeBSD : p7zip -- heap-based buffer overflow (6d337396-0e4a-11e8-94c0-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	2/12/2018	10/11/2019	high
106591	Debian DLA-1268-1 : p7zip security update	Nessus	Debian Local Security Checks	2/5/2018	1/11/2021	high
106878	Fedora 26 : p7zip (2018-7edc48be11)	Nessus	Fedora Local Security Checks	2/20/2018	1/6/2021	high
106593	Debian DSA-4104-1 : p7zip - security update	Nessus	Debian Local Security Checks	2/5/2018	11/13/2018	high
106821	Fedora 27 : p7zip (2018-29232aa760)	Nessus	Fedora Local Security Checks	2/15/2018	1/6/2021	high
106920	openSUSE Security Update : p7zip (openSUSE-2018-188)	Nessus	SuSE Local Security Checks	2/21/2018	1/19/2021	high
109800	7-Zip < 18.00 Multiple Vulnerabilities	Nessus	Windows	5/14/2018	11/15/2018	high
123074	Ubuntu 16.04 LTS : P7ZIP vulnerabilities (USN-3913-1)	Nessus	Ubuntu Local Security Checks	3/25/2019	10/20/2023	high
106645	Fedora 26 : p7zip (2018-cd4311d4d6)	Nessus	Fedora Local Security Checks	2/7/2018	1/6/2021	high
106648	Fedora 27 : p7zip (2018-f8ad787538)	Nessus	Fedora Local Security Checks	2/7/2018	1/6/2021	high
106897	SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2018:0464-1)	Nessus	SuSE Local Security Checks	2/20/2018	9/10/2019	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high