Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.

The remote host is affected by the vulnerability described in GLSA-201701-27 (7-Zip: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in 7-Zip. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted       archive file possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Update p7zip to 16.02 and fix security issues for CVE-2016-2335, CVE-2016-2334

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Cisco Talos reports :

An exploitable heap overflow vulnerability exists in the NArchive::NHfs::CHandler::ExtractZlibFile method functionality of 7zip that can lead to arbitrary code execution.

The version of 7-Zip installed on the remote Windows host is prior to 16.0. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exits in the     CHandler::ExtractZlibFile() function within file     Archive\HfsHandler.cpp due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this by convincing a user to open a     specially crafted file, resulting in the execution of     arbitrary code. (CVE-2016-2334)

  - An out-of-bounds read error exists in the     CInArchive::ReadFileItem() function within file     Archive\Udf\UdfIn.cpp when handling Universal Disk     Format (UDF) files. An unauthenticated, remote attacker     can exploit this by convincing a user to open a     specially crafted UDF file, resulting in the execution     of arbitrary code. (CVE-2016-2335)

ID	Name	Product	Family	Severity
96421	GLSA-201701-27 : 7-Zip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
92669	Fedora 23 : p7zip (2016-430bc0f808)	Nessus	Fedora Local Security Checks	high
92477	Fedora 24 : p7zip (2016-bbcb0e4eb4)	Nessus	Fedora Local Security Checks	high
92344	FreeBSD : p7zip -- heap overflow vulnerability (a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	high
91230	7-Zip < 16.00 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-2334

high

Tenable Plugins

high

high

high

high

high