Memory corruption in 7-Zip - CVE-2018-10115

Vulnerability identifier: #VU12359

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10115

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling solid compression. A remote attacker can create a specially crafted RAR archive, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

7-Zip
Arch Linux
openEuler
p7zip (Alpine package)
p7zip

Update to version 18.05.

p7zip (Alpine package) - update to 16.02-r3
p7zip - update to 16.02-3

• https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-execution/

• Remote code execution in 7-Zip
• Arch Linux update for p7zip
• Memory corruption in p7zip (Alpine package)
• openEuler 20.03 LTS SP2 update for p7zip