CVE-2017-17969
Fixed in a distro release EPSS 5%
Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.
Products: 7-zip, 7-zip p7zip, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | p7zip | 16.02-r2 |
| Alpine 3.11 | p7zip | 16.02-r2 |
| Alpine 3.12 | p7zip | 16.02-r2 |
| Alpine 3.13 | p7zip | 16.02-r2 |
| Alpine 3.14 | p7zip | 16.02-r2 |
| Alpine 3.15 | p7zip | 16.02-r2 |
| Alpine 3.16 | p7zip | 16.02-r2 |
| Alpine 3.17 | p7zip | 16.02-r2 |
| Alpine 3.5 | p7zip | 16.02-r2 |
| Alpine 3.6 | p7zip | 16.02-r2 |
| Alpine 3.7 | p7zip | 16.02-r2 |
| Alpine 3.8 | p7zip | 16.02-r2 |
| Alpine 3.9 | p7zip | 16.02-r2 |
| Debian 12 | p7zip | 16.02+dfsg-5 |
| Debian 13 | p7zip | 16.02+dfsg-5 |
| Debian 7 | p7zip | 9.20.1~dfsg.1-4+deb7u3 |
| Debian 8 | p7zip | 9.20.1~dfsg.1-4.1+deb8u3 |
| Debian 9 | p7zip | 16.02+dfsg-3+deb9u1 |
| SUSE Linux Enterprise Desktop 12 SP2 | p7zip | 9.20.1-7.3.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | p7zip | 9.20.1-7.3.1 |
| SUSE Linux Enterprise Server 12 SP2 | p7zip | 9.20.1-7.3.1 |
| SUSE Linux Enterprise Server 12 SP3 | p7zip | 9.20.1-7.3.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | p7zip | 9.20.1-7.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | p7zip | 9.20.1-7.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | p7zip | 9.20.1-7.3.1 |
| Ubuntu 14.04 LTS | p7zip | 9.20.1~dfsg.1-4+deb7u3build0.14.04.1 |
| Ubuntu 16.04 LTS | p7zip | 9.20.1~dfsg.1-4.2ubuntu0.1 |
| openSUSE Tumbleweed | p7zip | 16.02-11.3 |