Description
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =22.01+dfsg-10~exp1 || =22.01+dfsg-8 || =22.01+dfsg-8+deb12u1 || =22.01+dfsg-9 || =22.01+really25.01+dfsg-0+deb12u1 || =22.01+really26.01+dfsg-0+deb12u1 || >=0 <22.01+really26.02+dfsg-0+deb12u1 | 22.01+really26.02+dfsg-0+deb12u1 |
debian 13 | | =24.09+dfsg-8 || =25.00+dfsg-1 || =25.01+dfsg-1 || =25.01+dfsg-1~deb13u1 || =25.01+dfsg-1~deb13u1~bpo12+1 || =25.01+dfsg-1~deb13u2 || =25.01+dfsg-2 || =25.01+dfsg-3 || =25.01+dfsg-4 || =25.01+dfsg-5 || =26.00+dfsg-1 || =26.00+dfsg-2 || =26.00+dfsg-3 || =26.00+dfsg-4 || =26.00+dfsg-5 || =26.00+dfsg1-1 || =26.00+dfsg1-2 || =26.00+dfsg1-3 || =26.01+dfsg-1 || =26.01+dfsg-2 || =26.01+dfsg-3 || =26.02+dfsg-1 || =26.02+dfsg-2 || =26.02+dfsg-3 || =26.03+dfsg-1 || =26.03+dfsg-2 || =26.03+dfsg-3 | - |
debian 14 | | =24.09+dfsg-8 || =25.00+dfsg-1 || =25.01+dfsg-1 || =25.01+dfsg-1~deb13u1 || =25.01+dfsg-1~deb13u1~bpo12+1 || =25.01+dfsg-1~deb13u2 || =25.01+dfsg-2 || =25.01+dfsg-3 || =25.01+dfsg-4 || =25.01+dfsg-5 || =26.00+dfsg-1 || =26.00+dfsg-2 || =26.00+dfsg-3 || =26.00+dfsg-4 || =26.00+dfsg-5 || =26.00+dfsg1-1 || =26.00+dfsg1-2 || =26.00+dfsg1-3 || =26.01+dfsg-1 || =26.01+dfsg-2 || =26.01+dfsg-3 || >=0 <26.02+dfsg-1 | 26.02+dfsg-1 |
debian 12 | | =16.02+dfsg-8 || =16.02+really25.01+dfsg-0+deb12u1 || =16.02+really26.01+dfsg-0+deb12u1 || >=0 <16.02+really26.02+dfsg-0+deb12u1 | 16.02+really26.02+dfsg-0+deb12u1 |
debian 13 | | >=0 <16.02+transitional.1 | 16.02+transitional.1 |
