A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/94294 | Third Party Advisory VDB Entry |
| https://github.com/yangke/7zip-null-pointer-dereference | Issue Tracking Patch Third Party Advisory |
| https://sourceforge.net/p/p7zip/bugs/185/ | Issue Tracking Third Party Advisory |
| https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/ | Exploit Third Party Advisory |
| http://www.securityfocus.com/bid/94294 | Third Party Advisory VDB Entry |
| https://github.com/yangke/7zip-null-pointer-dereference | Issue Tracking Patch Third Party Advisory |
| https://sourceforge.net/p/p7zip/bugs/185/ | Issue Tracking Third Party Advisory |
| https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 03:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/94294 - Third Party Advisory, VDB Entry | |
| References | () https://github.com/yangke/7zip-null-pointer-dereference - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://sourceforge.net/p/p7zip/bugs/185/ - Issue Tracking, Third Party Advisory | |
| References | () https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/ - Exploit, Third Party Advisory |
Information
Published : 2016-11-12 02:59
Updated : 2024-11-21 03:00
NVD link : CVE-2016-9296
Mitre link : CVE-2016-9296
CVE.ORG link : CVE-2016-9296
JSON object : View
Products Affected
7-zip
- p7zip
CWE
CWE-476
NULL Pointer Dereference