Cisco TALOS has issued an advisory on May 11: http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html A comment there, plus one on the Debian bug, says 9.20 isn't affected by CVE-2016-2334, as the code was probably introduced in 9.32. As for 9.20.1, I don't know, but one could check the patch, linked from the upstream bug. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=824160 https://sourceforge.net/p/p7zip/discussion/383043/thread/9d0fb86b/?limit
Whiteboard: (none) => MGA5TOO
Ok done for Cauldron! Also I confirm that 9.20.1 release isn't affected by CVE-2016-2334, patch cannot be applied because code is not at all the same as 15.14.1 release. So what to do for mga5? just apply the patch for CVE-2016-2335?
(In reply to David GEIGER from comment #1) > So what to do for mga5? just apply the patch for CVE-2016-2335? Yes.
Version: Cauldron => 5Whiteboard: MGA5TOO => (none)
Well! done also for mga5!
Thanks! Advisory: ======================== Updated p7zip package fixes security vulnerability: An out of bound read vulnerability exists in the CInArchive::ReadFileItem method functionality of 7zip for handling UDF files that can lead to denial of service or code execution (CVE-2016-2335). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2335 http://www.talosintel.com/reports/TALOS-2016-0094/ http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html ======================== Updated packages in core/updates_testing: ======================== p7zip-9.20.1-6.2.mga5 from p7zip-9.20.1-6.2.mga5.src.rpm
CC: (none) => geiger.david68210Assignee: geiger.david68210 => qa-bugs
MGA5-64 [root@localhost brian]# urpmi p7zip Package p7zip-9.20.1-6.2.mga5.x86_64 is already installed [brian@localhost ~]$ 7z 7-Zip [64] 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18 p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,3 CPUs) 7z a -r emlp.7z ./*.flac -rw-r--r-- 1 brian brian 2079565218 May 20 14:12 emlp.7z moving file to a new location to extract. Opened with Archive Manager. (Archive Manager is using 7z to extract) First file and last files play correctly.
CC: (none) => brtians1Whiteboard: (none) => MGA5-64-OK
Keywords: (none) => validated_updateWhiteboard: MGA5-64-OK => has_procedure advisory MGA5-64-OKCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0202.html
Status: NEW => RESOLVEDResolution: (none) => FIXED