CVE-2024-11612: 7-Zip Qcow Handler Infinite Loop Denial-of-Service Vulnerability
7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/7zipto a version that resolves this vulnerability.Fixed in 22.01+really25.01+dfsg-0+deb12u1 - Upgrade
Upgrade
debian/7zipto a version that resolves this vulnerability.Fixed in 24.08+dfsg-1 - Upgrade
Upgrade
debian/p7zipto a version that resolves this vulnerability.Fixed in 16.02+really25.01+dfsg-0+deb12u1 - Upgrade
Upgrade
debian/p7zipto a version that resolves this vulnerability.Fixed in 16.02+transitional.1 - Upgrade
Upgrade
debian/7zipto a version that resolves this vulnerability.Fixed in 22.01+really26.01+dfsg-0+deb12u1Fixed in 22.01+really26.02+dfsg-0+deb12u1Fixed in 25.01+dfsg-1~deb13u2Fixed in 26.05+dfsg-1 - Upgrade
Upgrade
debian/p7zipto a version that resolves this vulnerability.Fixed in 16.02+really26.01+dfsg-0+deb12u1Fixed in 16.02+really26.02+dfsg-0+deb12u1Fixed in 16.02+transitional.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11612?
CVE-2024-11612 has a severity rating that indicates it can lead to a denial-of-service condition.
How do I fix CVE-2024-11612?
To mitigate CVE-2024-11612, you should update to the latest version of 7-Zip that addresses this vulnerability.
What impact does CVE-2024-11612 have on 7-Zip users?
CVE-2024-11612 can cause a denial-of-service, making 7-Zip unresponsive during exploitation.
Is CVE-2024-11612 remotely exploitable?
CVE-2024-11612 can be exploited by remote attackers, requiring some interaction with the affected software.
Which versions of 7-Zip are affected by CVE-2024-11612?
CVE-2024-11612 affects certain versions of 7-Zip, particularly those utilizing the CopyCoder library.