p7zip - Out-of-Bound Read Vulnerability
Summary
DLA-510-1: p7zip - security update. Affects p7zip versions < 9.20.1~dfsg.1-4+deb7u2. Fixed in 9.20.1~dfsg.1-4+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
p7zip is a file archiver with high compression ratio. It is used to compress and decompress files in the 7z format. The vulnerability affects p7zip version 9.20.1~dfsg.1-4+deb7u2 on Debian 7 Wheezy. This vulnerability allows a remote attacker to exploit an out-of-bound read vulnerability in the CInArchive::ReadFileItem method. By processing a specially crafted UDF file, an attacker can cause a denial-of-service or potentially execute arbitrary code with the privileges of the user running p7zip.
Vulnerability Detail
The vulnerability in p7zip arises from an out-of-bound read issue in the CInArchive::ReadFileItem method. This flaw can be exploited by a remote attacker who sends a specially crafted UDF file to the target system. If the file is processed by p7zip, it can lead to a denial-of-service condition or allow the attacker to execute arbitrary code with the privileges of the user running p7zip. This vulnerability has been assigned the identifier CVE-2016-2335.
How To Fix
Minimum fixed version
9.20.1~dfsg.1-4+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade p7zipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security update as soon as possible.
Conclusion
The p7zip package on Debian 7 Wheezy is vulnerable to an out-of-bound read vulnerability. This can be exploited by a remote attacker to cause a denial-of-service or execute arbitrary code. To mitigate this vulnerability, it is crucial to upgrade the p7zip package to version 9.20.1~dfsg.1-4+deb7u2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for p7zip →
FAQ
p7zip is a file archiver with high compression ratio. It is used to compress and decompress files in the 7z format.
This vulnerability allows a remote attacker to cause a denial-of-service or potentially execute arbitrary code with the privileges of the user running p7zip.
To fix this vulnerability, upgrade the p7zip package to version 9.20.1~dfsg.1-4+deb7u2 or later.
There is no known workaround for this vulnerability. It is recommended to apply the security update.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki page.
Related vulnerabilities
Recent vulnerabilities recorded for p7zip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
