8.8
HIGH
CVE-2016-2335
7zip UDF Parsing Buffer Overflow/Out-of-Bounds Read Denial of Service/Arbitrary Code Execution Vulnerability
Description

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.

INFO

Published Date :

June 7, 2016, 2:06 p.m.

Last Modified :

Nov. 7, 2023, 2:31 a.m.

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.8
Public PoC/Exploit Available at Github

CVE-2016-2335 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2016-2335 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Debian debian_linux
1 Opensuse opensuse
1 7-zip 7-zip

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Инструкция по сборке пакетов для Росы. Создается сообществом. Коммиты приветствуются. Для визуального редактирования Markdown рекомендуем редактор Remarkable: https://remarkableapp.github.io/linux.html

Updated: 6 months, 3 weeks ago
2 stars 2 fork 2 watcher
Born at : July 2, 2017, 10:03 p.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2016-2335 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2016-2335 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference CERT/CC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/ [No types assigned]
    Added Reference CERT/CC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/ [No types assigned]
    Removed Reference CERT/CC https://lists.fedoraproject.org/archives/list/[email protected]/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/
    Removed Reference CERT/CC https://lists.fedoraproject.org/archives/list/[email protected]/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/
  • CVE Modified by [email protected]

    Mar. 21, 2019

    Action Type Old Value New Value
    Added Reference https://usn.ubuntu.com/3913-1/ [No Types Assigned]
  • CPE Deprecation Remap by [email protected]

    Oct. 30, 2018

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:novell:opensuse:13.2:*:*:*:*:*:*:* OR *cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
  • Modified Analysis by [email protected]

    Oct. 09, 2018

    Action Type Old Value New Value
    Changed Reference Type https://security.gentoo.org/glsa/201701-27 No Types Assigned https://security.gentoo.org/glsa/201701-27 Third Party Advisory
    Changed Reference Type http://www.securitytracker.com/id/1035876 No Types Assigned http://www.securitytracker.com/id/1035876 Third Party Advisory, VDB Entry
    Changed Reference Type http://www.talosintel.com/reports/TALOS-2016-0094/ Exploit http://www.talosintel.com/reports/TALOS-2016-0094/ Exploit, Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-updates/2016-06/msg00004.html No Types Assigned http://lists.opensuse.org/opensuse-updates/2016-06/msg00004.html Mailing List, Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-updates/2016-06/msg00098.html No Types Assigned http://lists.opensuse.org/opensuse-updates/2016-06/msg00098.html Mailing List, Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-updates/2016-07/msg00069.html No Types Assigned http://lists.opensuse.org/opensuse-updates/2016-07/msg00069.html Mailing List, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/ Third Party Advisory
    Changed Reference Type http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html No Types Assigned http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html Exploit, Third Party Advisory
    Changed Reference Type http://www.securityfocus.com/bid/90531 No Types Assigned http://www.securityfocus.com/bid/90531 Third Party Advisory, VDB Entry
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/ Third Party Advisory
    Changed Reference Type http://www.debian.org/security/2016/dsa-3599 No Types Assigned http://www.debian.org/security/2016/dsa-3599 Third Party Advisory
    Changed Reference Type http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html No Types Assigned http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* OR *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    Changed CPE Configuration OR *cpe:2.3:a:7-zip:7zip:9.20:*:*:*:*:*:*:* *cpe:2.3:a:7-zip:7zip:15.05:beta:*:*:*:*:*:* OR *cpe:2.3:a:7-zip:7-zip:9.20:*:*:*:*:*:*:* *cpe:2.3:a:7-zip:7-zip:15.05:beta:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jul. 01, 2017

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/201701-27 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 15, 2016

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/DNYIQAU3FKFBNFPK6GKYTSVRHQA7PTYT/ [No Types Assigned]
    Added Reference http://www.securitytracker.com/id/1035876 [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/DTGWICT3KYYDPDXRNO5SXD32GZICGRIR/ [No Types Assigned]
    Added Reference http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 30, 2016

    Action Type Old Value New Value
    Added Reference http://lists.opensuse.org/opensuse-updates/2016-06/msg00098.html [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2016

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/90531 [No Types Assigned]
    Added Reference http://lists.opensuse.org/opensuse-updates/2016-07/msg00069.html [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 27, 2016

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
  • Modified Analysis by [email protected]

    Jun. 21, 2016

    Action Type Old Value New Value
    Changed CPE Configuration Configuration 1 OR *cpe:2.3:o:novell:opensuse:13.2:*:*:*:*:*:*:* Configuration 2 OR *cpe:2.3:a:7-zip:7zip:15.05:beta:*:*:*:*:*:* *cpe:2.3:a:7-zip:7zip:9.20:*:*:*:*:*:*:* Configuration 1 OR *cpe:2.3:o:novell:opensuse:13.2:*:*:*:*:*:*:* Configuration 2 OR *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Configuration 3 OR *cpe:2.3:a:7-zip:7zip:15.05:beta:*:*:*:*:*:* *cpe:2.3:a:7-zip:7zip:9.20:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jun. 21, 2016

    Action Type Old Value New Value
    Added Reference http://www.debian.org/security/2016/dsa-3599
  • CVE Translated by [email protected]

    Jun. 17, 2016

    Action Type Old Value New Value
    Removed Translation El método CInArchive::ReadFileItem en Archive/Udf/UdfIn.cpp en 7zip 9.20 y 15.05 beta permite a atacantes remotos provocar una denegación de servicio (lectura fuera de límites) o ejecutar código arbitrario a través del campo PartitionRef en el Long Allocation Descriptor en un archivo UDF.
    Added Translation El método CInArchive::ReadFileItem en Archive/Udf/UdfIn.cpp en 7zip 9.20 y 15.05 beta y p7zip permite a atacantes remotos provocar una denegación de servicio (lectura fuera de rango) o ejecutar código arbitrario a través de un archivo PartitionRef en Long Allocation Descriptor en un archivo UDF.
  • CVE Modified by [email protected]

    Jun. 17, 2016

    Action Type Old Value New Value
    Changed Description The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file. The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.
  • Modified Analysis by [email protected]

    Jun. 09, 2016

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:o:novell:opensuse:13.2:*:*:*:*:*:*:* Configuration 2 OR *cpe:2.3:a:7-zip:7zip:15.05:beta:*:*:*:*:*:* *cpe:2.3:a:7-zip:7zip:9.20:*:*:*:*:*:*:*
    Added CVSS V2 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
    Added CVSS V3 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Changed Reference Type http://www.talosintel.com/reports/TALOS-2016-0094/ No Types Assigned http://www.talosintel.com/reports/TALOS-2016-0094/ Exploit
    Added CWE CWE-119
  • Initial Analysis by [email protected]

    Jun. 07, 2016

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

1.30 }} 0.10%

score

0.84446

percentile

CVSS30 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability