#1109494 7zip-rar: CVE-2025-53816

Package:
src:7zip-rar
Source:
src:7zip-rar
Submitter:
Salvatore Bonaccorso
Date:
2025-07-19 12:59:03 UTC
Severity:
normal
Tags:
#1109494#5
Date:
2025-07-19 05:46:50 UTC
From:
To:
Hi,

The following vulnerabilities were published for 7zip.

CVE-2025-53816[0]:
| 7-Zip is a file archiver with a high compression ratio. Zeroes
| written outside heap buffer in RAR5 handler may lead to memory
| corruption and denial of service in versions of 7-Zip prior to
| 25.0.0. Version 25.0.0 contains a fix for the issue.


CVE-2025-53817[1]:
| 7-Zip is a file archiver with a high compression ratio. 7-Zip
| supports extracting from Compound Documents. Prior to version
| 25.0.0, a null pointer dereference in the Compound handler may lead
| to denial of service. Version 25.0.0 contains a fix cor the issue.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-53816
https://www.cve.org/CVERecord?id=CVE-2025-53816
https://securitylab.github.com/advisories/GHSL-2025-058_7-Zip/
[1] https://security-tracker.debian.org/tracker/CVE-2025-53817
https://www.cve.org/CVERecord?id=CVE-2025-53817
https://securitylab.github.com/advisories/GHSL-2025-059_7-Zip/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
#1109494#14
Date:
2025-07-19 06:12:38 UTC
From:
To:
close 1109494 25.00+dfsg-1
thanks
#1109494#19
Date:
2025-07-19 10:15:37 UTC
From:
To:
Hi,

Looking at
https://securitylab.github.com/advisories/GHSL-2025-058_7-Zip/ it seems
CVE-2025-53816 is affecting [p]7zip-rar.

The analyzed faulty code lies in CPP/7zip/Compress/Rar5Decoder.cpp which
is excluded from [p]7zip (per debian/copyright).

The code is modified in 25.00 import:
https://github.com/ip7z/7zip/commit/fc662341e6f85da78ada0e443f6116b978f79f22#diff-88a430830000a0af8a34f1f0839670eea79d7b201bad3e5662e97159075880cbR1905-R1906

The My_ZeroMemory logic appears to have been introduced in the 24.05 import:
https://github.com/ip7z/7zip/commit/395149956d696e6e3099d8b76d797437f94a6942#diff-88a430830000a0af8a34f1f0839670eea79d7b201bad3e5662e97159075880cbL1905-R1941

Cheers!
Sylvain Beucler
Debian LTS Team
#1109494#24
Date:
2025-07-19 10:31:25 UTC
From:
To:
             UInt64 rem = _lzEnd - _lzSize;
             ...
             memset(_window + pos, 0, rem2);
is present in the same function in earlier versions, it may be similarly
exploitable.

Cheers!
Sylvain Beucler
Debian LTS Team
#1109494#29
Date:
2025-07-19 12:56:11 UTC
From:
To:
Hi

Yes it looks I messed up things. I'm reassigning this bug for
CVE-2025-53816 only to 7zip-rar.

CVE-2025-53817 should be correct, but remains unimportant given only
beeing a crash in CLI tool.

Regards,
Salvatore