The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| 7 Zip 7 Zip | — | Upgrade 7-Zip to the latest version | Jul 26, 2024 | Jun 7, 2016 |
| Debian | — | Upgrade p7zip | Jun 9, 2016 | Jun 7, 2016 |
| Freebsd | — | Upgrade p7zip | Dec 10, 2025 | Jul 15, 2016 |
| Gentoo Linux | — | Upgrade app-arch/p7zip. | Oct 30, 2017 | Jun 7, 2016 |
| Oracle Solaris | — | Upgrade compress/p7zip to version 16.2.1-0.175.3.29.0.1.0 on Solaris 11.3 | May 29, 2017 | Jun 7, 2016 |
| Suse | — | Upgrade p7zip | Jun 7, 2016 | Jun 7, 2016 |
| Ubuntu | — | Upgrade p7zip-fullUpgrade p7zip | Apr 1, 2019 | Jun 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub