ECHO-eefb-b682-dc9b
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-eefb-b682-dc9b.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ECHO-eefb-b682-dc9b
- Upstream
- Withdrawn
- 2026-07-19T16:41:19Z
- Published
- 2026-07-19T16:41:19Z
- Modified
- 2026-09-15T00:47:33Z
- Summary
- Low-severity (CVSS 3.1 2.5, CWE-754, Debian "unimportant") error-reporting quirk: 7-Zip 22.01 silently returns OK for an xz file with reserved bits set in the block flags instead of flagging it. No memory-safety impact. NVD's affected-version data is pinned to exactly 22.01 and states "Some later versions are unaffected"; remediated upstream by version currency, not by a separate patch, so there is nothing to backport. Verified against the reporter's PoC (boofish/semantic-bugs pocs/poc1.xz) on this build's 25.01 binaries: the standalone 7za/7zr hard-error (exit 2, "Is not archive") and 7zz/7z no longer silently accept it (now emit "Warnings: 1"), so the reported silent-acceptance behavior does not reproduce.
- Details
- References