{"id":"CVE-2021-3465","aliases":["EUVD-2021-26787","MGASA-2021-0305","SUSE-SU-2021:1491-1","UBUNTU-CVE-2021-3465","openSUSE-SU-2021:0684-1","openSUSE-SU-2024:11137-1"],"status":"rejected","title":"Updated p7zip package fixes security vulnerabilities","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-04-12T15:15:00Z","modified":"2026-04-16T04:43:27Z","fixes":[{"ecosystem":"Mageia:7","package":"p7zip","fixed_in":["17.03-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"p7zip","fixed_in":["17.03-1.1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"p7zip","fixed_in":["16.02-14.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"p7zip","fixed_in":["16.02-14.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"p7zip","fixed_in":["16.02-lp152.8.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.03-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.03-1.1.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-14.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-14.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.20.1~dfsg.1-4","9.20.1~dfsg.1-4+deb7u1build0.14.04.1","9.20.1~dfsg.1-4+deb7u2build0.14.04.1","9.20.1~dfsg.1-4+deb7u3build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.20.1~dfsg.1-4.2","9.20.1~dfsg.1-4.2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.02+dfsg-4","16.02+dfsg-5","16.02+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.02+dfsg-7","16.02+dfsg-7build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-lp152.8.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02-11.3"}]}],"bundled":2}],"references":[{"url":"https://www.suse.com/security/cve/CVE-2021-3465.html"},{"url":"https://advisories.mageia.org/CVE-2021-3465.html"},{"url":"https://security.archlinux.org/CVE-2021-3465"},{"url":"https://advisories.mageia.org/MGASA-2021-0305.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28903","tags":["report"]},{"url":"https://github.com/jinfeihan57/p7zip/releases","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OQBZYFULI5NBGLWDHKHSVMRMYNY2XC5Q/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OJQ6YRT2OALFI2LGZSLJD5T74MV6PJ7V/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211491-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184699","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3465","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-3465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3465","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OQBZYFULI5NBGLWDHKHSVMRMYNY2XC5Q/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17969","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3465","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","modified":"2023-02-12T00:00:00Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26787","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","modified":"2023-02-12T00:00:00Z","updated_at":"2026-11-03T03:51:01.523493Z"}],"nvd":[{"id":"CVE-2021-3465","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2021-04-12T15:15:15.703Z","modified":"2023-11-07T03:38:01.213Z","updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"MGASA-2021-0305","title":"Updated p7zip package fixes security vulnerabilities","description":"In p7zip-17.03, the function NCompress::CCopyCoder::Code in\nCPP/7zip/Common/StreamObjects.cpp will call outStream-\u003eWrite where a memcpy\nuses a NULL pointer as destination address, leading to a crash (CVE-2021-3465).\n\nNull pointer dereference in function Reserve() found in p7zip 16.02\n(rhbz#1951218).\n\nNull Pointer Dereference  in function NArchive::NLzh::CItem::GetUnixTime found\nin p7zip 16.02 (rhbz#1951224).\n\nThe p7zip package has been patched to fix these issues.\n\nAlso, the Mageia 7 package has been updated to version 17.03.\n","status":"published","published":"2021-06-30T23:58:41Z","modified":"2026-04-16T04:43:27.475948596Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0684-1","title":"Security update for p7zip","description":"This update for p7zip fixes the following issues:\n\n- CVE-2021-3465: Fixed a NULL pointer dereference in NCompress:CCopyCoder:Code (bsc#1184699)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-05-07T22:05:55Z","modified":"2026-02-04T04:02:50.201911Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11137-1","title":"p7zip-16.02-11.3 on GA media","description":"These are all security issues fixed in the p7zip-16.02-11.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:09.865441Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:1491-1","title":"Security update for p7zip","description":"This update for p7zip fixes the following issues:\n\n- CVE-2021-3465: Fixed a NULL pointer dereference in NCompress:CCopyCoder:Code (bsc#1184699)\n","status":"published","published":"2021-05-04T15:11:15Z","modified":"2026-02-04T04:22:53.424Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"UBUNTU-CVE-2021-3465","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2021-04-12T15:15:00Z","modified":"2025-10-24T04:49:11Z","updated_at":"2026-11-02T15:54:27.870979Z"}]}}