PT-2018-6599 · Igor Pavlov+3 · 7-Zip+4

Landave

·

Publicado

2018-01-30

·

Atualizado

2025-01-10

·

CVE-2017-17969

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: 7-Zip versions prior to 18.00 p7zip (affected versions not specified)
Description: The issue is a heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method. This allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.
Recommendations: For 7-Zip versions prior to 18.00, update to version 18.00 or later to resolve the issue. For p7zip, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider avoiding the use of the NCompress::NShrink::CDecoder::CodeReal method until a patch is available.

Exploit

DoS

Memory Corruption

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALT-PU-2018-2591
AZL-35092
AZL-6783
CVE-2017-17969
DLA-1268-1
DSA-4104-1
MGASA-2018-0123
OESA-2021-1294
OPENSUSE-SU-2018_0497-1
OPENSUSE-SU-2024:11137-1
SUSE-SU-2018:0464-1
USN-3913-1

Produtos afetados

7-Zip
Alt Linux
Suse
Ubuntu
P7Zip