CVE-2023-52169 Affecting 7zip package, versions <22.01+dfsg-8+deb12u1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN12-7ZIP-7420302
- published 4 Jul 2024
- disclosed 3 Jul 2024
Introduced: 3 Jul 2024
CVE-2023-52169 Open this link in a new tabHow to fix?
Upgrade Debian:12 7zip to version 22.01+dfsg-8+deb12u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream 7zip package and not the 7zip package as distributed by Debian.
See How to fix? for Debian:12 relevant fixed versions and status.
The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.