{"id":"CVE-2023-31102","aliases":["DEBIAN-CVE-2023-31102","EUVD-2023-35429","GHSA-4cc6-f2xj-w7jx","UBUNTU-CVE-2023-31102"],"status":"published","title":"7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z...","description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.53987,"percentile":0.99012,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2023-11-03T00:00:00Z","modified":"2026-10-26T18:01:03Z","fixes":[{"ecosystem":"Debian:12","package":"7zip","fixed_in":["22.01+really25.01+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"7zip","fixed_in":["23.01+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"7zip","fixed_in":["23.01+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"p7zip","fixed_in":["16.02+really25.01+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"p7zip","fixed_in":["16.02+transitional.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01+really25.01+dfsg-0+deb12u1"}]}],"versions":["22.01+dfsg-10~exp1","22.01+dfsg-8","22.01+dfsg-8+deb12u1","22.01+dfsg-9"]},{"source":"osv","ecosystem":"Debian:13","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02+really25.01+dfsg-0+deb12u1"}]}],"versions":["16.02+dfsg-8"]},{"source":"osv","ecosystem":"Debian:13","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02+transitional.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.03~beta+dfsg-6","21.04~beta+dfsg-1","21.06+dfsg-1","21.07+dfsg-1","21.07+dfsg-2","21.07+dfsg-3","21.07+dfsg-4","21.07+dfsg-4ubuntu0.1~esm1"]}],"products":[{"vendor":"7-zip","product":"7-zip"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"oncommand_workflow_automation"}],"references":[{"url":"https://www.7-zip.org/download.html","tags":["x_transferred","Product","web"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-1165/","tags":["x_transferred","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/","tags":["x_transferred","Issue Tracking","Release Notes","report"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31102"},{"url":"https://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102"},{"url":"https://security.netapp.com/advisory/ntap-20231110-0007"},{"url":"https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269"},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-1165"},{"url":"https://github.com/advisories/GHSA-4cc6-f2xj-w7jx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-31102","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-31102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31102","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-31102","description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","status":"published","published":"2023-11-03T00:00:00Z","modified":"2024-09-06T13:43:35.116Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-35429","description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","status":"published","published":"2023-11-03T00:00:00Z","modified":"2024-09-06T13:43:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:02.201955Z"}],"ghsa":[{"id":"GHSA-4cc6-f2xj-w7jx","title":"7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z...","description":"7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z archive.","status":"published","published":"2023-11-03T06:36:29Z","modified":"2024-09-06T15:33:57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:58:11.330333Z"}],"nvd":[{"id":"CVE-2023-31102","description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","status":"published","published":"2023-11-03T04:15:20.793Z","modified":"2026-06-17T05:56:17.91Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"CVE-2023-31102","description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","status":"published","published":"2023-11-03T04:15:20.793Z","modified":"2026-03-15T14:49:54.946889Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"DEBIAN-CVE-2023-31102","description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","status":"published","published":"2023-11-03T04:15:20.793Z","modified":"2026-10-26T18:01:03.926045386Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-31102","description":"Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.","status":"published","published":"2023-11-03T04:15:00Z","modified":"2025-10-24T05:01:57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"}]}}