Is p7zip affected by remote code execution security vulnerabilities of "normal" 7zip?

[therealmarv]

Seems 7zip 22.01 from Igor Pavlov was affected by these two new found security bugs:

• CVE-2023-40481
• CVE-2023-31102

It seems those issues allow remote code execution by opening files !!!

7zip has released new versions (23.01) which apparently fixes those issues.

Unfortunately p7zip is the default on many Linux distros out there.

Any statements about those two security issues?

[tansy]

Any statements about those two security issues?

Yes. You can go to sf.net/p/sevenzip, download and compare versions 22.01 and 23.01, get what it does to solve the issue, incorporate it to 17.05, request a pull and get an award for being security hero.

Ed. Here is diff between v22.01 and v23.01.
It's where this vulnerability (squashfs) is fixed. you're welcome to incoreporate it to v17.05.

[tansy]

What's interesting, Pavlov says that

p7zip 16.02 is not affected by CVE-2023-31102