VDB
DEBIAN-CVE-2023-52169
DEBIAN-CVE-2023-52169
PUBLISHED
CVSS 8.199999809265137 HIGH
The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | p7zip | 0, 0, 0 |
| Debian:12 | p7zip | 16.02+transitional.1, 0, 16.02+dfsg-8 |
| Debian:14 | 7zip | 0, 0, 0 |
| Debian:13 | 7zip | 0, 0, 0 |
| Debian:12 | 7zip | 0, 22.01+dfsg-8, 0 |
| Debian:11 | p7zip | 0, 16.02+dfsg-8, 16.02+transitional.1 |
Exploit Intelligence
- zigpos-zimt-grype.html (github-poc)
Timeline
- Jul 3, 2024 CVE Published
- May 16, 2026 CVE Updated