Critical Memory Corruption Vulnerability in p7zip Package
Summary
ALPINE-CVE-2018-5996: Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of se... Affects p7zip versions < 16.02-r3. Fixed in 16.02-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
p7zip is a command-line port of the 7-Zip file archiver, which is widely used for compressing and decompressing files. It supports various archive formats, including RAR, ZIP, and 7z. The package is known for its high compression ratio and is commonly utilized in Unix-like operating systems, including Alpine Linux. However, it has been found to have a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2018-5996, arises from insufficient exception handling in the NCompress::NRar3::CDecoder::Code method of p7zip. This flaw can lead to multiple memory corruptions within the PPMd code, allowing remote attackers to exploit crafted RAR archives. The consequences include potential denial of service (segmentation fault) or arbitrary code execution, posing a significant threat to systems utilizing this package.
How To Fix
Minimum fixed version
16.02-r3
This is the first release that contains the fix.
sudo apk add --upgrade p7zipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted RAR archives until the package is updated. Additionally, consider using alternative archiving tools that do not have this vulnerability.
Conclusion
The p7zip package has a critical vulnerability (CVE-2018-5996) that can lead to severe security risks, including memory corruption and arbitrary code execution. Users are advised to update to the patched version 16.02-r3 or later to mitigate these risks. For real-time monitoring of vulnerabilities, consider using Vulert.
See every vulnerability recorded for p7zip →
FAQ
CVE-2018-5996 is a critical vulnerability in the p7zip package that can lead to memory corruption and potential remote code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of CVE-2018-5996 is 7.8, indicating a high severity level.
If immediate updates are not possible, refrain from using untrusted RAR files and consider alternative archiving tools until the vulnerability is patched.
More information about p7zip can be found on its official website or through its documentation, which details its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for p7zip.
