Description
7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 13 | | =24.09+dfsg-8 || =25.00+dfsg-1 || =25.01+dfsg-1 || =25.01+dfsg-1~deb13u1 || =25.01+dfsg-1~deb13u1~bpo12+1 || =25.01+dfsg-1~deb13u2 || =25.01+dfsg-2 || =25.01+dfsg-3 || =25.01+dfsg-4 || =25.01+dfsg-5 || =26.00+dfsg-1 || =26.00+dfsg-2 || =26.00+dfsg-3 || =26.00+dfsg-4 || =26.00+dfsg-5 || =26.00+dfsg1-1 || =26.00+dfsg1-2 || =26.00+dfsg1-3 || =26.01+dfsg-1 || =26.01+dfsg-2 || =26.01+dfsg-3 || =26.02+dfsg-1 || =26.02+dfsg-2 || =26.02+dfsg-3 || =26.03+dfsg-1 || =26.03+dfsg-2 || =26.03+dfsg-3 | - |
debian 14 | | =24.09+dfsg-8 || =25.00+dfsg-1 || =25.01+dfsg-1 || =25.01+dfsg-1~deb13u1 || =25.01+dfsg-1~deb13u1~bpo12+1 || =25.01+dfsg-1~deb13u2 || =25.01+dfsg-2 || =25.01+dfsg-3 || =25.01+dfsg-4 || =25.01+dfsg-5 || =26.00+dfsg-1 || =26.00+dfsg-2 || =26.00+dfsg-3 || =26.00+dfsg-4 || =26.00+dfsg-5 || =26.00+dfsg1-1 || =26.00+dfsg1-2 || =26.00+dfsg1-3 || >=0 <26.01+dfsg-1 | 26.01+dfsg-1 |
 alpine v3.24 | | | 26.01-r0 |
debian 12 | | =16.02+dfsg-8 || =16.02+really25.01+dfsg-0+deb12u1 || >=0 <16.02+really26.01+dfsg-0+deb12u1 | 16.02+really26.01+dfsg-0+deb12u1 |
debian 12 | | =22.01+dfsg-10~exp1 || =22.01+dfsg-8 || =22.01+dfsg-8+deb12u1 || =22.01+dfsg-9 || =22.01+really25.01+dfsg-0+deb12u1 || >=0 <22.01+really26.01+dfsg-0+deb12u1 | 22.01+really26.01+dfsg-0+deb12u1 |
debian 13 | | >=0 <16.02+transitional.1 | 16.02+transitional.1 |
