[Git][security-tracker-team/security-tracker][master] CVE-2026-58052/7zip,p7zip: initial triage

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5e69436b by Sylvain Beucler at 2026-07-13T21:50:16+02:00
CVE-2026-58052/7zip,p7zip: initial triage

Following discussion at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138181
and https://lists.debian.org/debian-lts/2026/07/msg00038.html

Using <ignored> rather than <not-affected> to err on the safe side.
This CVE is most probably going to be fixed by the next upload anyway,
by bumping to 26.02 or later as usual.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -9868,7 +9868,15 @@ CVE-2026-58054 (MyBB 1.8.40 does not restrict which usergroup a limited Admin Co
 CVE-2026-58053 (Gitea act_runner with the Docker backend (through act 0.262.0) passes  ...)
 	- gitea <removed>
 CVE-2026-58052 (7-Zip for Windows through 26.02 fails to preserve the Mark-of-the-Web  ...)
-	TODO: check
+	- 7zip 26.02+dfsg-2
+	[bookworm] - 7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g)
+	- p7zip 16.02+transitional.1
+	[bookworm] - p7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g)
+	[bullseye] - p7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g)
+	NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package
+	NOTE: depending on 7zip. Mark this version as fixed version.
+	NOTE: https://github.com/bikini/exploitarium/tree/main/7zip-rar5-motw-chain-poc
+	NOTE: https://lists.debian.org/debian-lts/2026/07/msg00038.html
 CVE-2026-58051 (libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but  ...)
 	- libssh2 <undetermined>
 	NOTE: https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e69436b5256c312db7a31242126e5514fc60559

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e69436b5256c312db7a31242126e5514fc60559
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260713/1de20c7b/attachment.htm>