CVE-2023-52169

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52169
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52169.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-52169
Related
Published
2024-07-03T18:15:04Z
Modified
2024-11-09T12:50:58.887607Z
Summary
[none]
Details

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.

References

Affected packages

Debian:12 / 7zip

Package

Name
7zip
Purl
pkg:deb/debian/7zip?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.01+dfsg-8+deb12u1

Affected versions

22.*

22.01+dfsg-8

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / 7zip

Package

Name
7zip
Purl
pkg:deb/debian/7zip?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
24.05+dfsg-1

Affected versions

22.*

22.01+dfsg-8
22.01+dfsg-9
22.01+dfsg-10~exp1

23.*

23.01+dfsg-1
23.01+dfsg-2
23.01+dfsg-3
23.01+dfsg-4~exp1
23.01+dfsg-4
23.01+dfsg-5
23.01+dfsg-6
23.01+dfsg-7
23.01+dfsg-8
23.01+dfsg-9
23.01+dfsg-10
23.01+dfsg-11
23.01+dfsg-12

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:11 / p7zip

Package

Name
p7zip
Purl
pkg:deb/debian/p7zip?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

16.*

16.02+dfsg-8
16.02+transitional.1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:12 / p7zip

Package

Name
p7zip
Purl
pkg:deb/debian/p7zip?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

16.*

16.02+dfsg-8
16.02+transitional.1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:13 / p7zip

Package

Name
p7zip
Purl
pkg:deb/debian/p7zip?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
16.02+transitional.1

Affected versions

16.*

16.02+dfsg-8

Ecosystem specific 

{
    "urgency": "unimportant"
}