{"id":"CVE-2016-9296","aliases":["ALPINE-CVE-2016-9296","AZL-35091","AZL-6782","DEBIAN-CVE-2016-9296","EUVD-2016-10107","GHSA-mqw8-2gg2-v87m","OESA-2021-1294","UBUNTU-CVE-2016-9296","openSUSE-SU-2024:10322-1"],"status":"published","title":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null...","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07016,"percentile":0.94214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2016-11-12T02:19:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"p7zip","fixed_in":["16.02-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"p7zip","fixed_in":["16.02-23"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"p7zip","fixed_in":["16.02-22"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"p7zip","fixed_in":["16.02+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"p7zip","fixed_in":["16.02+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-r1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-22"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02+dfsg-2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-3.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-2.1"}]}],"bundled":4}],"products":[{"vendor":"7-zip","product":"p7zip"}],"references":[{"url":"http://www.securityfocus.com/bid/94294","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://sourceforge.net/p/p7zip/bugs/185/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/yangke/7zip-null-pointer-dereference","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9296","tags":["web","advisory"]},{"url":"https://sourceforge.net/p/p7zip/bugs/185"},{"url":"https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db"},{"url":"https://github.com/advisories/GHSA-mqw8-2gg2-v87m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9296","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9296","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10115","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9296","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9296","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9296","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:19:00Z","modified":"2024-08-06T02:42:11.265Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-10107","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:19:00Z","modified":"2024-08-06T02:42:11Z","updated_at":"2026-11-03T02:22:27.654814Z"}],"ghsa":[{"id":"GHSA-mqw8-2gg2-v87m","title":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null...","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2022-05-17T03:38:38Z","modified":"2025-04-12T13:07:33Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:01:30.348567Z"}],"nvd":[{"id":"CVE-2016-9296","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:59:04.65Z","modified":"2026-06-17T00:55:47.83Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:32.086916Z"}],"osv":[{"id":"ALPINE-CVE-2016-9296","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:59:04.65Z","modified":"2026-09-22T06:30:44.905941429Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"AZL-35091","title":"CVE-2016-9296 affecting package p7zip for versions less than 16.02-23","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:59:04Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6782","title":"CVE-2016-9296 affecting package p7zip for versions less than 16.02-22","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:59:04Z","modified":"2026-04-21T04:38:16.031433Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2016-9296","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:59:04.65Z","modified":"2026-03-13T22:21:48.200672Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-9296","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"published","published":"2016-11-12T02:59:04.65Z","modified":"2026-09-22T07:02:44.885169089Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"OESA-2021-1294","title":"p7zip security update","description":"7za for Linux system to archive file as 7z file format\r\n\r\nSecurity Fix(es):\r\n\r\nHeap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.(CVE-2017-17969)\r\n\r\nInsufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.(CVE-2018-5996)\r\n\r\nIncorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.(CVE-2018-10115)\r\n\r\nA null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.(CVE-2016-9296)","status":"published","published":"2021-07-31T11:04:32Z","modified":"2026-08-18T01:15:52.933018715Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2016-9296","description":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","status":"withdrawn","published":"2016-11-12T02:59:00Z","modified":"2025-07-16T07:35:15.962124Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"openSUSE-SU-2024:10322-1","title":"p7zip-16.02-2.1 on GA media","description":"These are all security issues fixed in the p7zip-16.02-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:07.754244Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}