Heap-based Buffer Overflow in p7zip
Summary
DLA-1268-1: p7zip - security update. Affects p7zip versions < 9.20.1~dfsg.1-4+deb7u3. Fixed in 9.20.1~dfsg.1-4+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
p7zip is an open-source file archiver program that supports various compression formats, including ZIP. It is widely used for compressing and decompressing files on Debian 7 Wheezy systems. However, a vulnerability has been discovered in the NCompress::NShrink::CDecoder::CodeReal method of the 7-Zip library, which is utilized by p7zip. This vulnerability allows remote attackers to exploit a heap-based buffer overflow by providing a specially crafted ZIP archive. The impact of this vulnerability can range from a denial of service (out-of-bounds write) to potential arbitrary code execution.
Vulnerability Detail
The heap-based buffer overflow in p7zip's NCompress::NShrink::CDecoder::CodeReal method allows remote attackers to exploit the vulnerability by providing a malicious ZIP archive. By carefully crafting the archive, an attacker can trigger an out-of-bounds write, potentially leading to a denial of service or arbitrary code execution. This vulnerability poses a significant risk to systems running p7zip on Debian 7 Wheezy.
How To Fix
Minimum fixed version
9.20.1~dfsg.1-4+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade p7zipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to p7zip as soon as possible to mitigate the risk.
Conclusion
The heap-based buffer overflow vulnerability in p7zip's NCompress::NShrink::CDecoder::CodeReal method poses a significant risk to systems running p7zip on Debian 7 Wheezy. It is crucial to apply the recommended security update to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for p7zip →
FAQ
p7zip is an open-source file archiver program that supports various compression formats, including ZIP. It is commonly used for compressing and decompressing files on Debian 7 Wheezy systems.
Remote attackers can exploit this vulnerability by providing a specially crafted ZIP archive to p7zip. By triggering the heap-based buffer overflow, they can potentially execute arbitrary code or cause a denial of service.
The impact of this vulnerability can range from a denial of service (out-of-bounds write) to potential arbitrary code execution. It poses a significant risk to systems running p7zip on Debian 7 Wheezy.
No, there is no known workaround for this vulnerability. It is crucial to apply the security update to p7zip to mitigate the risk.
You can update the p7zip package using the package manager of your Debian 7 Wheezy system. Ensure that you upgrade to version 9.20.1~dfsg.1-4+deb7u3 or later.
Related vulnerabilities
Recent vulnerabilities recorded for p7zip.
