CVE-2016-2335

High

Published: 07/06/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The CInArchive::ReadFileItem method in 7zip versions 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the integrity and availability of the system.

Recommendation

It is recommended to update to the latest version of 7zip or p7zip to mitigate this vulnerability.

Other vulnerabilities in 7zip, p7zip

CVE-2016-2334High
CVE-2016-2334 describes a heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before version 16.00 and p7zip. This allows remote attackers to execute arbitrary code via a crafted HFS+ image.

Original NVD description (English source)

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.