4 ms·

Great, p7zip is also affected according to an earlier article [1] and the last version 16.02 is from 2016 [2] This open source libraries are used everywhere :(

Great, p7zip is also affected according to an earlier article [1] and the last version 16.02 is from 2016 [2] This open source libraries are used everywhere :( [1]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ https://landave.io/2018/01/7-zip-multiple-memory-corruptions... [2]: https://sourceforge.net/projects/p7zip/files/p7zip/ https://sourceforge.net/projects/p7zip/files/p7zip/

landave 8y ago
Note that the standard 'p7zip' package from Debian/Ubuntu doesn't support RAR. However, they have an additional package 'p7zip-full' or 'p7zip-rar' for RAR support. I didn't check explicitly, but I assume these are affected.
- pkkm 8y ago
  I checked the versions in buster (p7zip-full 16.02+dfsg-6, p7zip-rar 16.02-2) and they look unaffected to me. Turns out that the Debian maintainers patch upstream sources to include hardening flags, e.g. -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wl,-z,relro. You can use hardening-check to check the binaries on your system.
  - landave 8y ago
    Okay, so these packages come with more mitigations than 7-Zip on Windows. However, looking at the source code, I am pretty sure they are affected by the same bug.
    - pkkm 8y ago
      "Unaffected" was probably the wrong word to use. What I meant is that one of the mitigations (making the executables position-independent) should prevent the bug from being exploitable for remote code execution on Debian.
      - therealmarv 8y ago
        thanks for the inside information about p7zip! That's really good to know!