The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | 7zip | <= 22.01+dfsg-8 | 7zip_22.01+dfsg-8_all.deb |
Debian | 999 | all | 7zip | < 24.05+dfsg-1 | 7zip_24.05+dfsg-1_all.deb |
Debian | 13 | all | 7zip | < 24.05+dfsg-1 | 7zip_24.05+dfsg-1_all.deb |
Debian | 12 | all | p7zip | <= 16.02+dfsg-8 | p7zip_16.02+dfsg-8_all.deb |
Debian | 11 | all | p7zip | <= 16.02+dfsg-8 | p7zip_16.02+dfsg-8_all.deb |
Debian | 999 | all | p7zip | < 16.02+transitional.1 | p7zip_16.02+transitional.1_all.deb |
Debian | 13 | all | p7zip | < 16.02+transitional.1 | p7zip_16.02+transitional.1_all.deb |