7-Zip versions prior to 16.00 suffer from code execution and various other vulnerabilities.
9f796f1af89d7aa0d638e43def7b8d0e70a285275a25793a5d06f71c464ca9c1
Just karma whoring here, since I noticed the announcement and figured
the news needs to spread. Cisco Talis discovered a number of bugs in
7zip versions prior to 16.00, some of which lead to arbitrary code
execution when processing certain malformed archives:
http://www.zdnet.com/article/severe-7-zip-vulnerabilities-cause-top-security-software-tools-patch-panic/#ftag=RSSbaffb68
http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html
Versions from 9.20 to 15.00 are said to contain some or all of the bugs.
The comment stream in the 2nd link contains this remark:
"By default 7zip will pass inputs through all of its decompression
routines so blocking certain extensions will not work unless you also
pass a command line argument that specifies the parser to use. These
bugs will trigger with a malformed UDF/HFS file with a .zip extension
unless the added command line argument is used."
Upgrading to 7zip V16.00 ("as soon as possible") is said to fix the
vulnerabilities.
The official 7zip changelog at http://www.7-zip.org/history.txt for
16.00 just says "Some bugs were fixed".
I should add dates: the 7zip V16.00 release is dated 10.May.2016, and
the Cisco Talis blog post is dated 11.May.2016.
Also affected versions are all below 16.00, not just 15.00 and prior.
Nick