CVE-2017-17969: Buffer Overflow
Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/p7zipto a version that resolves this vulnerability.Fixed in 16.02+dfsg-5Fixed in 16.02+dfsg-3+deb9u1Fixed in 9.20.1~dfsg.1-4.1+deb8u3 - Upgrade
Upgrade
debian/p7zipto a version that resolves this vulnerability.Fixed in 16.02+really26.01+dfsg-0+deb12u1Fixed in 16.02+really26.02+dfsg-0+deb12u1Fixed in 16.02+transitional.1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2017-17969.
What is the severity of CVE-2017-17969?
The severity of CVE-2017-17969 is high with a score of 7.8.
What is the affected software?
The affected software is 7-Zip before version 18.00 and p7zip.
How can a remote attacker exploit CVE-2017-17969?
A remote attacker can exploit CVE-2017-17969 by sending a crafted ZIP archive, potentially causing a denial of service or executing arbitrary code.
Where can I find more information about CVE-2017-17969?
You can find more information about CVE-2017-17969 at the following references: [link1], [link2], [link3].