CVE-2024-11612
published 2024-11-22CVE-2024-11612: 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected…
PriorityP433medium6.5CVSS 3.0
AVNACLPRNUIRSUCNINAH
EPSS
1.69%
74.2th percentile
7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 7-zip | 7-zip | — | — |
| 7-zip | 7-zip | >= 24.06 < 24.08 | 24.08 |
| 7-zip | p7zip | >= 0 < 16.02+transitional.1 | 16.02+transitional.1 |
| debian | 7zip | < 7zip 24.08+dfsg-1 (forky) | 7zip 24.08+dfsg-1 (forky) |
| debian | p7zip | < 7zip 24.08+dfsg-1 (forky) | 7zip 24.08+dfsg-1 (forky) |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_oracle6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-11612: 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability
osv·2024-11-22·CVSS 6.5
CVE-2024-11612 [MEDIUM] CVE-2024-11612: 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability
7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.
GHSA
GHSA-jrq3-7p6q-9m8h: 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability
ghsa_unreviewed·2024-11-22
CVE-2024-11612 [MEDIUM] CWE-835 GHSA-jrq3-7p6q-9m8h: 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability
7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Build (7-Zip) — CVE-2024-11612
vendor_oracle·2025-04-15·CVSS 6.5
CVE-2024-11612 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Build (7-Zip) — CVE-2024-11612
Oracle Oracle Fusion Middleware Risk Matrix: Build (7-Zip) vulnerability
CVE: CVE-2024-11612
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Debian
CVE-2024-11612: 7zip - 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerabilit...
vendor_debian·2024·CVSS 6.5
CVE-2024-11612 [MEDIUM] CVE-2024-11612: 7zip - 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerabilit...
7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.
Scope: local
bookworm: open
forky: resolved (fixed in 24.08+dfsg-1)
sid: resolved (fixed in 24.08+dfsg-1)
trixie: resolved (fixed in 24.08+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-22
Published