CVE-2016-9296 — NULL Pointer Dereference in P7zip
Severity
7.5HIGHNVD
EPSS
1.7%
top 17.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 12
Latest updateMay 17
Description
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages24 packages
Patches
🔴Vulnerability Details
2📋Vendor Advisories
2Microsoft▶
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams ↗2016-11-08
Debian▶
CVE-2016-9296: p7zip - A null pointer dereference bug affects the 16.02 and many old versions of p7zip....↗2016