PT-2023-4537 · Igor Pavlov+2 · 7-Zip+2

Goodbyeselene · Published 2023-08-23 · Updated 2026-01-30 · CVE-2023-31102

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 23.00

Description The issue is related to an integer underflow in the 7z file parser component of 7-Zip, allowing a remote attacker to execute arbitrary code on affected installations. This can be achieved by tricking the victim into opening a crafted archive. There have been reports of offensive activities targeting this vulnerability.

Recommendations For versions prior to 23.00, update to version 23.00 or later to resolve the issue. As a temporary workaround, consider avoiding the use of 7-Zip to open archives from untrusted sources until the update is applied.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

BDU:2023-04942

CVE-2023-31102

ZDI-23-1165

Affected Products

7-Zip

Debian

Red Os

References · 28

• https://ubuntu.com/security/CVE-2023-31102 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/697873 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31102 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1165 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-31102 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-31102 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-31102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04942 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31102 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/713181 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-31102 · Security Note
• https://twitter.com/governa/status/1696717794870485330 · Twitter Post
• https://twitter.com/vuldb/status/1696538203698929914 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1720316190126457033 · Twitter Post