7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.
History

Wed, 11 Dec 2024 19:45:00 +0000

Type Values Removed Values Added
First Time appeared 7-zip 7-zip
CPEs cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*
Vendors & Products 7-zip 7-zip
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}


Mon, 02 Dec 2024 14:15:00 +0000

Type Values Removed Values Added
First Time appeared 7-zip
7-zip 7zip
CPEs cpe:2.3:a:7-zip:7zip:*:*:*:*:*:*:*:*
Vendors & Products 7-zip
7-zip 7zip
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 22 Nov 2024 20:30:00 +0000

Type Values Removed Values Added
Description 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.
Title 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability
Weaknesses CWE-191
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published: 2024-11-22T20:22:33.278Z

Updated: 2024-12-02T14:09:05.550Z

Reserved: 2024-11-19T22:30:03.057Z

Link: CVE-2024-11477

cve-icon Vulnrichment

Updated: 2024-12-02T14:08:49.353Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-22T21:15:08.613

Modified: 2024-12-11T19:23:36.800

Link: CVE-2024-11477

cve-icon Redhat

No data.