Everyone, get your update hats on immediately; we're at DEFCON 1

you are viewing a single comment's thread
view the rest of the comments
[–] 45 points 5 months ago (6 children)

application my man. Literally the first paragraph of the article contains:

If a user simply opens a booby-trapped crafted archive (.7z, .zip, .rar, etc) on a machine with at least 16 GB of RAM, they'll be running malicious code. Extracting the archive isn't necessary; only opening it is enough. We recommend that everyone immediately update to the latest version, 26.01, published in late April; all previous versions are vulnerable.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 35 points 5 months ago (4 children)

    ...and because i'm sure people still won't read the article, this also includes countless things that use 7zip libraries to do zipping actions, including things like file browsers, chocolatey and probably other stuff. 7zip is foss and widely used for all kinds of things t hat go beyond consumer gui usage.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 14 points 5 months ago (2 children)

    That’s exactly why I asked for clarification. Is this an issue with their executable or is it their compression code?

    I use Keka for macOS, which uses 7zip’s code for handling .7z archives. So I should probably hope for a quick update from them.

  • source
  • parent
  • hideshow 2 child comments