Heap-Based Buffer Overflow Vulnerability in p7zip Package
Summary
ALPINE-CVE-2017-17969: Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary... Affects p7zip versions < 16.02-r2. Fixed in 16.02-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
p7zip is a command-line version of 7-Zip, a popular file archiver with a high compression ratio. It is widely used for compressing and decompressing files in various formats, including ZIP and 7z. The package is essential for users who require efficient file storage and transfer. However, it has been found to be vulnerable to a heap-based buffer overflow, which can be exploited by attackers to execute arbitrary code or cause denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2017-17969, originates from a flaw in the NCompress::NShrink::CDecoder::CodeReal method in p7zip versions prior to 16.02-r2. This flaw allows remote attackers to craft a malicious ZIP archive that, when processed by p7zip, can lead to an out-of-bounds write. The consequences of this vulnerability include potential execution of arbitrary code and denial of service, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
16.02-r2
This is the first release that contains the fix.
sudo apk add --upgrade p7zipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted ZIP archives until the package is updated. Additionally, consider using alternative archiving tools that are not affected by this vulnerability.
Conclusion
The heap-based buffer overflow vulnerability in the p7zip package poses significant risks, including potential code execution and denial of service. Users are strongly advised to update to the patched version 16.02-r2 to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for p7zip →
FAQ
CVE-2017-17969 is a vulnerability in the p7zip package that allows remote attackers to exploit a heap-based buffer overflow.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to denial of service or allow attackers to execute arbitrary code on the affected system.
Yes, the patch is available in version 16.02-r2 of the p7zip package. Users should update to this version or later.
If an immediate update is not possible, avoid processing untrusted ZIP files and consider using alternative archiving tools.
References
Related vulnerabilities
Recent vulnerabilities recorded for p7zip.
