[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2023-31102/p7zip: affected

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
66fde24e by Sylvain Beucler at 2026-03-02T19:03:29+01:00
CVE-2023-31102/p7zip: affected

Ppmd7.c and affected code are present.

- - - - -
417e0546 by Sylvain Beucler at 2026-03-02T19:10:14+01:00
CVE-2023-40481/p7zip: affected

I can't find any evidence for not-affected, and other dists like RedHat and Gentoo assigned it to p7zip as well.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -286195,13 +286195,16 @@ CVE-2023-31103 (Exposure of Resource to Wrong Sphere Vulnerability in Apache Sof
 CVE-2023-40481 (7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution  ...)
 	- 7zip 23.01+dfsg-1
 	[bookworm] - 7zip <no-dsa> (Minor issue; will be fixed via point release)
+	- p7zip <removed>
 	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1164/
 	NOTE: https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/
 CVE-2023-31102 (Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid  ...)
 	- 7zip 23.01+dfsg-1
 	[bookworm] - 7zip <no-dsa> (Minor issue; will be fixed via point release)
+	- p7zip <removed>
 	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1165/
 	NOTE: https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/
+	NOTE: https://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102/
 CVE-2023-31101 (Insecure Default Initialization of Resource Vulnerability in Apache So ...)
 	NOT-FOR-US: Apache InLong
 CVE-2023-31100 (Improper Access Control in SMI handler vulnerability in Phoenix Secure ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/990dc0f01e9b83e2f087ab94bc12eb959772582a...417e0546cb6dd81acdb654b1f314a17ad4bac987

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/990dc0f01e9b83e2f087ab94bc12eb959772582a...417e0546cb6dd81acdb654b1f314a17ad4bac987
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260302/bfb9279e/attachment.htm>