CVE-2016-9296: Null Pointer Dereference

Published Nov 12, 2016

Updated

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.

Affected Software

1 affected component

7-Zip p7zip=16.02

Remediation

Patch Available

https://github.com/yangke/7zip-null-pointer-dereference

Event History

Nov 12, 2016

CVE Published

via MITRE·02:19 AM

Data Sourced

via MITRE·02:19 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-9296?

CVE-2016-9296 is classified as a medium severity vulnerability due to its potential to cause application crashes.

How do I fix CVE-2016-9296?

To fix CVE-2016-9296, you should upgrade to a version of p7zip that is not affected by the vulnerability.

What systems are affected by CVE-2016-9296?

CVE-2016-9296 affects the p7zip version 16.02 and many older versions.

What type of vulnerability is CVE-2016-9296?

CVE-2016-9296 is a null pointer dereference vulnerability.

What is the impact of CVE-2016-9296?

The impact of CVE-2016-9296 may lead to crashes in applications using the vulnerable p7zip library.