ZDI-CAN-24307: ZDI-24-1606: 7-Zip Qcow Handler Infinite Loop Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
Other sources
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2024-11612.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-24307?
The severity of ZDI-CAN-24307 is classified as high due to its potential to cause a denial-of-service condition.
How do I fix ZDI-CAN-24307?
To fix ZDI-CAN-24307, ensure that you update to the latest version of 7-Zip, as patches may address this vulnerability.
What versions of 7-Zip are affected by ZDI-CAN-24307?
ZDI-CAN-24307 affects specific versions of 7-Zip, particularly those prior to the latest security updates.
Can ZDI-CAN-24307 be exploited remotely?
Yes, ZDI-CAN-24307 can be exploited remotely if an attacker interacts with the vulnerable library.
What types of denial-of-service attacks are associated with ZDI-CAN-24307?
ZDI-CAN-24307 can lead to various denial-of-service conditions depending on the implementation and context of the attack.