CVE-2023-52168
Fixed in a distro release EPSS <1%CVSS 8.4
The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512*i-2, for i=9, i=10, i=11, etc.
Products: 7-zip 7zip
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | p7zip | 16.02-20.amzn2023.0.6 |
| Amazon Linux 2023 | p7zip-doc | 16.02-20.amzn2023.0.6 |
| Amazon Linux 2023 | p7zip-plugins | 16.02-20.amzn2023.0.6 |
| Debian 12 | 7zip | 22.01+dfsg-8+deb12u1 |
| Debian 12 | p7zip | 16.02+really25.01+dfsg-0+deb12u1 |
| Debian 13 | 7zip | 24.05+dfsg-1 |
| Debian 13 | p7zip | 16.02+transitional.1 |
| Debian 14 | 7zip | 24.05+dfsg-1 |
| SUSE Enterprise Storage 7.1 | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Server 12 SP5 | p7zip | 9.20.1-7.6.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | p7zip | 9.20.1-7.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | p7zip | 16.02-150200.14.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | p7zip | 16.02-150200.14.12.1 |
| SUSE Manager Proxy 4.3 | p7zip | 16.02-150200.14.12.1 |
| SUSE Manager Server 4.3 | p7zip | 16.02-150200.14.12.1 |
| Ubuntu Pro 22.04 LTS | 7zip | 21.07+dfsg-4ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | 7zip | 23.01+dfsg-11ubuntu0.1~esm1 |
| openSUSE Leap 15.5 | p7zip | 16.02-150200.14.12.1 |
| openSUSE Leap 15.6 | p7zip | 16.02-150200.14.12.1 |