CVE-2023-52169
Published: July 3rd, 2024
The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.
HIGH
CVSS v3: 8.2
CVSS v3: 8.2
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| daily | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 26.3 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 26.2 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 26.1 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 25.4 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 25.3 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 25.2 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 25.1 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 24.4 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 24.4.0 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 24.3 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 24.2 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 24.1 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 23.3 | 7-zip (23.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 23.2 | 7-zip (17.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 23.1 | 7-zip (17.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
| 22.4 | 7-zip (17.01) | Not Affected | Code Not Present | The out-of-bounds read is in the NTFS handler (NtfsHandler.cpp) of the full 7-Zip application, which is not part of the LZMA SDK that Document Filters uses. That handler is absent from our source tree and never compiled. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
NETWORK
Availability Impact
HIGH
Base Score
8.2
Base Severity
HIGH
Confidentiality Impact
LOW
Integrity Impact
NONE
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Version
3.1