4 ms·

The discovered vulnerabilities are in the 7-Zip application's UDF and HFS+ filesystem image support.

• striking 10y ago
  I didn't even realize 7-Zip could open those.
  • infogulch 10y ago
    7-Zip is the VLC of file containers.
    • giancarlostoro 10y ago
      It is my default whenever I'm on Windows. Everyone loves to close the "trial" window on software when there's usually a better open source alternative. The hidden gem in 7-Zip is you can set file association, it's just not enabled by default which makes it seem more complicated to newcomers than it really is.
      • nwah1 10y ago
        PeaZip is like a friendly version of 7zip, and uses the 7zip code. 7zip is not very well maintained, whereas PeaZip has regular releases.
        • poizan42 10y ago
          > 7zip is not very well maintained, whereas PeaZip has regular releases. 16.00 2016-05-10 15.14 2015-12-31 15.12 2015-11-19 15.11 beta 2015-11-14 15.10 beta 2015-11-01 15.09 beta 2015-10-16 15.08 beta 2015-10-01 15.07 beta 2015-09-17 ... How is that not regular?
          • nwah1 10y ago
            Perhaps lately. Prior to this past November, the stable release advertised on their site had been stuck on the same version for years, without even any point releases. And they use SourceForge for hosting. The code quality may be excellent, but it just seemed to me that they were not too well organized, logistically, compared to other projects.
            • poizan42 10y ago
              The version they consider "stable" is rarely updated. That just means they have a very high standard for when it's considered stable. If you look through the changelog you'll see that the largest gaps between any releases was from 9.25 alpha (2011-09-16) to 9.30 alpha (2012-10-26).
            • TeMPOraL 10y ago
              Why would they need regular releases? This is not a web startup, it's an archive compression/decompression tool. It worked perfectly well 5 years ago.
              • giancarlostoro 10y ago
                I was wondering the same. Unless it involves a security being ignored for a year or more, I don't see much of an issue with a lack of updates. I rather a developer takes their time to write their code vs. speed coding and publishing new bugs left and right.
                • nwah1 10y ago
                  I find it unlikely that there would be no memory leaks needing patching, no important compiler updates, and no API-compatible dependency updates that should've been applied to the stable release. The Linux Kernel, Firefox, and lots of projects have some sort of Long Term Service branch where simple uncontroversial improvements are added. Modern best practices for releasing open source software are important, and a project that doesn't seem aware of any of them makes me concerned about their attention to detail.
        • deleted 10y ago
          [deleted]
      • arkitaip 10y ago
        Not really sure why you would need regular releases for handing zip files, though.
        • valarauca1 10y ago
          Windows handles zip files horribly. The time to extract a 100MB zip in windows explorer is 4-6minutes (if not more). Compare this to ~30seconds in 7zip.
          • deleted 10y ago
            [deleted]
          • dave2000 10y ago
            Windows ignores the partition you're unzipping to and writes to the c drive, then does a very slow, tedious move to the destination partition. It's obvious it should use the destination partition in the first place.
    • skoczymroczny 10y ago
      Too bad it doesn't support unpacking .tar.gz files in a single step like their competition (WinZip) does.