p PatchFirst

PatchFirst · Latest vulnerabilities

p7zip vulnerabilities · Page 2

Vulnerabilities published for p7zip in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 29

  1. CVE-2023-40481

    High · CVSS 7.8EPSS 13.95%Fix available

    7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SQFS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18589.

    p7zipOperating systems
    • Update to 16.02+transitional.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2022-47069

    High · CVSS 7.8EPSS 0.32%Fix available

    CVE-2022-47069

    p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp. NOTE: the Supplier has found that this is not a buffer overflow; at most an out-of-bounds read can occur.

    p7zipOperating systems
    • Update to 16.02+transitional.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2016-9296

    High · CVSS 7.5EPSS 7.02%Fix available

    CVE-2016-9296

    A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.

    p7zipOperating systems
    • Update to 16.02+dfsg-2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2016-2335

    High · CVSS 8.8EPSS 9.79%Fix available

    CVE-2016-2335

    The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.

    p7zipOperating systems
    • Update to 15.14.1+dfsg-2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →