CVE-2022-47069
Fixed in a distro release EPSS <1%
p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp. NOTE: the Supplier has found that this is not a buffer overflow; at most an out-of-bounds read can occur.
Products: 7-zip p7zip
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | p7zip | 16.02-20.amzn2023.0.5 |
| Amazon Linux 2023 | p7zip-doc | 16.02-20.amzn2023.0.5 |
| Amazon Linux 2023 | p7zip-plugins | 16.02-20.amzn2023.0.5 |
| Debian 12 | p7zip | 16.02+really25.01+dfsg-0+deb12u1 |
| Debian 13 | p7zip | 16.02+transitional.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | p7zip | 16.02-150200.14.15.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | p7zip | 16.02-150200.14.15.1 |
| Ubuntu 14.04 LTS | p7zip | no fix |
| Ubuntu 16.04 LTS | p7zip | no fix |
| Ubuntu 18.04 LTS | p7zip | no fix |
| Ubuntu 20.04 LTS | p7zip | no fix |
| Ubuntu 22.04 LTS | p7zip | no fix |
| Ubuntu 24.04 LTS | p7zip | no fix |
| Ubuntu 25.10 | p7zip | no fix |
| openSUSE Leap 15.6 | p7zip | 16.02-150200.14.15.1 |