CVE search · CVE-2016-2334
CVE-2016-2334
high 7.8
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cret@cert.org
- Weakness
- CWE-119
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.0 | high 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | high 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- 7-zip · 7-zip
- fedoraproject · fedora
- oracle · solaris
References
- http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.htmlExploitThird Party Advisory
- http://blog.talosintelligence.com/2017/11/exploiting-cve-2016-2334.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.htmlPatchThird Party Advisory
- http://www.securityfocus.com/bid/90531Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1035876Third Party AdvisoryVDB Entry
- http://www.talosintel.com/reports/TALOS-2016-0093/ExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/
- https://security.gentoo.org/glsa/201701-27
- http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.htmlExploitThird Party Advisory
- http://blog.talosintelligence.com/2017/11/exploiting-cve-2016-2334.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.htmlPatchThird Party Advisory
- http://www.securityfocus.com/bid/90531Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1035876Third Party AdvisoryVDB Entry
- http://www.talosintel.com/reports/TALOS-2016-0093/ExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/
- https://security.gentoo.org/glsa/201701-27