Everyone, get your update hats on immediately; we're at DEFCON 1

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 5 months ago (2 children)

That actually doesn't seem to be so severe.

How many people download some random archive and then, after extracting it, they double click on the files inside it?

It says the risk of this vuln is arbitrary code execution of a maliciously crafted archive.

After fixing this bug, most 7zip users will still be vulnerable to arbitrary code execution due to maliciously crafted archives.

  • source
  • hideshow 2 child comments
  • [–] 5 points 5 months ago (1 child)

    According to the last paragraph, the vulnerability is in reading the archive itself, not the decompressed contents.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 5 months ago

    I think what quick snail is saying is that if you are going to download a malicious zip file you are just as likely to unzip the archive and run the program inside. It's a lot easier to just have a malicious payload inside the archive.

  • source
  • parent