CVE-2023-52169

NameCVE-2023-52169
DescriptionThe NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
7zip (PTS)bookworm22.01+dfsg-8+deb12u1fixed
sid, trixie24.09+dfsg-2fixed
p7zip (PTS)jessie, jessie (lts)9.20.1~dfsg.1-4.1+deb8u3vulnerable
stretch (security), stretch (lts), stretch16.02+dfsg-3+deb9u1vulnerable
buster16.02+dfsg-6vulnerable
bullseye, bookworm16.02+dfsg-8vulnerable
sid, trixie16.02+transitional.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
7zipsourcebookworm22.01+dfsg-8+deb12u1
7zipsource(unstable)24.05+dfsg-1unimportant
p7zipsource(unstable)16.02+transitional.1unimportant

Notes

Crash in CLI tool, no security impact
https://sourceforge.net/p/sevenzip/bugs/2402/
https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/
https://www.openwall.com/lists/oss-security/2024/07/03/10
Since p7zip/16.02+transitional.1 src:p7zip is only a empty source package
depending on 7zip. Mark this version as fixed version.

Search for package or bug name: Reporting problems