Critical security bug found in 7-Zip

[Newsfeed]

Critical security bug found in 7-Zip

7-Zip has released a patch for a critical security bug (CVE-2018-10115) in the code which allows it to handle RAR files, Sophos reported.

The security researcher who found the bug, and developed a working exploit for it, has subsequently published his findings.

 

[mercurial]

Interesting. Junior developers should read this.

 

[Bryn]

Was worried for a moment, but I see it's nothing that would have affected me.

 

[system32]

7-Zip still my go to app for compression.

Seems the issue is with unRAR code used by 7-Zip.

Good to see it patched.

 

[sajunky]

Seems the issue is with unRAR code used by 7-Zip.

From my understanding it was implementer's responsibility to initialise all variables.

According to the researcher, there were several uninitialised variables in the UnRAR code, as used by 7-Zip,