Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
66fde24e by Sylvain Beucler at 2026-03-02T19:03:29+01:00
CVE-2023-31102/p7zip: affected
Ppmd7.c and affected code are present.
- - - - -
417e0546 by Sylvain Beucler at 2026-03-02T19:10:14+01:00
CVE-2023-40481/p7zip: affected
I can't find any evidence for not-affected, and other dists like RedHat and
Gentoo assigned it to p7zip as well.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -286195,13 +286195,16 @@ CVE-2023-31103 (Exposure of Resource to Wrong
Sphere Vulnerability in Apache Sof
CVE-2023-40481 (7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code
Execution ...)
- 7zip 23.01+dfsg-1
[bookworm] - 7zip <no-dsa> (Minor issue; will be fixed via point
release)
+ - p7zip <removed>
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1164/
NOTE:
https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/
CVE-2023-31102 (Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and
invalid ...)
- 7zip 23.01+dfsg-1
[bookworm] - 7zip <no-dsa> (Minor issue; will be fixed via point
release)
+ - p7zip <removed>
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1165/
NOTE:
https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/
+ NOTE:
https://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102/
CVE-2023-31101 (Insecure Default Initialization of Resource Vulnerability in
Apache So ...)
NOT-FOR-US: Apache InLong
CVE-2023-31100 (Improper Access Control in SMI handler vulnerability in
Phoenix Secure ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/990dc0f01e9b83e2f087ab94bc12eb959772582a...417e0546cb6dd81acdb654b1f314a17ad4bac987
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/990dc0f01e9b83e2f087ab94bc12eb959772582a...417e0546cb6dd81acdb654b1f314a17ad4bac987
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
