CVE-2016-2334

High

Published: 13/12/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2016-2334 describes a heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before version 16.00 and p7zip. This allows remote attackers to execute arbitrary code via a crafted HFS+ image.

Risk Assessment

Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise. This poses a serious threat to data security and system integrity.

Recommendation

It is recommended to upgrade to version 16.00 or later of 7zip and p7zip to mitigate this vulnerability. Additionally, systems should be monitored for unauthorized activities.

Other vulnerabilities in 7zip, p7zip

CVE-2016-2335High
The CInArchive::ReadFileItem method in 7zip versions 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.

Original NVD description (English source)

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.