Description
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 14 | | =24.09+dfsg-8 || =25.00+dfsg-1 || =25.01+dfsg-1 || =25.01+dfsg-1~deb13u1 || =25.01+dfsg-1~deb13u1~bpo12+1 || =25.01+dfsg-1~deb13u2 || =25.01+dfsg-2 || =25.01+dfsg-3 || =25.01+dfsg-4 || =25.01+dfsg-5 || =26.00+dfsg-1 || =26.00+dfsg-2 || =26.00+dfsg-3 || =26.00+dfsg-4 || =26.00+dfsg-5 || =26.00+dfsg1-1 || =26.00+dfsg1-2 || =26.00+dfsg1-3 || =26.01+dfsg-1 || =26.01+dfsg-2 || =26.01+dfsg-3 || =26.02+dfsg-1 || =26.02+dfsg-2 || =26.02+dfsg-3 || >=0 <26.03+dfsg-1 | 26.03+dfsg-1 |
debian 12 | | =16.02+dfsg-8 || =16.02+really25.01+dfsg-0+deb12u1 || =16.02+really26.01+dfsg-0+deb12u1 || =16.02+really26.02+dfsg-0+deb12u1 || =16.02+transitional.1 | - |
debian 12 | | =22.01+dfsg-10~exp1 || =22.01+dfsg-8 || =22.01+dfsg-8+deb12u1 || =22.01+dfsg-9 || =22.01+really25.01+dfsg-0+deb12u1 || =22.01+really26.01+dfsg-0+deb12u1 || =22.01+really26.02+dfsg-0+deb12u1 || =23.01+dfsg-1 || =23.01+dfsg-10 || =23.01+dfsg-11 || =23.01+dfsg-12 || =23.01+dfsg-2 || =23.01+dfsg-3 || =23.01+dfsg-4 || =23.01+dfsg-4~exp1 || =23.01+dfsg-5 || =23.01+dfsg-6 || =23.01+dfsg-7 || =23.01+dfsg-8 || =23.01+dfsg-9 || =24.05+dfsg-1 || =24.05+dfsg-2 || =24.05+dfsg-3 || =24.06+dfsg-1 || =24.06+dfsg-2 || =24.06+dfsg-3 || =24.06+dfsg-4 || =24.07+dfsg-1 || =24.07+dfsg-2 || =24.08+dfsg-1 || =24.08+dfsg-1~bpo12+1 || =24.08+dfsg-2 || =24.09+dfsg-1 || =24.09+dfsg-2 || =24.09+dfsg-2~bpo12+1 || =24.09+dfsg-3 || =24.09+dfsg-4 || =24.09+dfsg-5 || =24.09+dfsg-6 || =24.09+dfsg-7 || =24.09+dfsg-7~bpo12+1 || =24.09+dfsg-8 || =24.09+dfsg-8~bpo12+1 || =25.00+dfsg-1 || =25.01+dfsg-1 || =25.01+dfsg-1~deb13u1 || =25.01+dfsg-1~deb13u1~bpo12+1 || =25.01+dfsg-1~deb13u2 || =25.01+dfsg-2 || =25.01+dfsg-3 || =25.01+dfsg-4 || =25.01+dfsg-5 || =26.00+dfsg-1 || =26.00+dfsg-2 || =26.00+dfsg-3 || =26.00+dfsg-4 || =26.00+dfsg-5 || =26.00+dfsg1-1 || =26.00+dfsg1-2 || =26.00+dfsg1-3 || =26.01+dfsg-1 || =26.01+dfsg-2 || =26.01+dfsg-3 || =26.02+dfsg-1 || =26.02+dfsg-2 || =26.02+dfsg-3 || =26.03+dfsg-1 || =26.03+dfsg-2 || =26.03+dfsg-3 | - |
debian 13 | | =24.09+dfsg-8 || =25.00+dfsg-1 || =25.01+dfsg-1 || =25.01+dfsg-1~deb13u1 || =25.01+dfsg-1~deb13u1~bpo12+1 || =25.01+dfsg-1~deb13u2 || =25.01+dfsg-2 || =25.01+dfsg-3 || =25.01+dfsg-4 || =25.01+dfsg-5 || =26.00+dfsg-1 || =26.00+dfsg-2 || =26.00+dfsg-3 || =26.00+dfsg-4 || =26.00+dfsg-5 || =26.00+dfsg1-1 || =26.00+dfsg1-2 || =26.00+dfsg1-3 || =26.01+dfsg-1 || =26.01+dfsg-2 || =26.01+dfsg-3 || =26.02+dfsg-1 || =26.02+dfsg-2 || =26.02+dfsg-3 || =26.03+dfsg-1 || =26.03+dfsg-2 || =26.03+dfsg-3 | - |
debian 13 | | >=0 <16.02+transitional.1 | 16.02+transitional.1 |
