CVE-2023-52169 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2023-52169 Interim 1 9 2025-05-17T00:39:53Z current 2024-07-03T23:31:01Z 2025-05-17T00:39:53Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2023-52169 The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2024-July/018980.html E-Mail link for SUSE-SU-2024:2475-1 https://lists.suse.com/pipermail/sle-security-updates/2024-July/019049.html E-Mail link for SUSE-SU-2024:2625-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 12 SP3-LTSS-TERADATA SUSE Linux Enterprise Server 12 SP3-TERADATA SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP4-TERADATA SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.5 openSUSE Leap 15.6 p7zip p7zip-16.02-150200.14.12.1 p7zip-9.20.1-7.6.1 p7zip-doc-16.02-150200.14.12.1 p7zip-full-16.02-150200.14.12.1 p7zip-16.02-150200.14.12.1 as a component of SUSE Enterprise Storage 7.1 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Enterprise Storage 7.1 p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 p7zip-9.20.1-7.6.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS-TERADATA p7zip-9.20.1-7.6.1 as a component of SUSE Linux Enterprise Server 12 SP3-TERADATA p7zip-9.20.1-7.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA p7zip-9.20.1-7.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 p7zip-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 p7zip-16.02-150200.14.12.1 as a component of SUSE Manager Proxy 4.3 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Manager Proxy 4.3 p7zip-16.02-150200.14.12.1 as a component of SUSE Manager Retail Branch Server 4.3 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Manager Retail Branch Server 4.3 p7zip-16.02-150200.14.12.1 as a component of SUSE Manager Server 4.3 p7zip-full-16.02-150200.14.12.1 as a component of SUSE Manager Server 4.3 p7zip-16.02-150200.14.12.1 as a component of openSUSE Leap 15.5 p7zip-doc-16.02-150200.14.12.1 as a component of openSUSE Leap 15.5 p7zip-full-16.02-150200.14.12.1 as a component of openSUSE Leap 15.5 p7zip-16.02-150200.14.12.1 as a component of openSUSE Leap 15.6 p7zip-doc-16.02-150200.14.12.1 as a component of openSUSE Leap 15.6 p7zip-full-16.02-150200.14.12.1 as a component of openSUSE Leap 15.6 p7zip as a component of SUSE Linux Enterprise Server 12 SP4-LTSS p7zip as a component of SUSE Linux Enterprise Server 15 SP1-LTSS p7zip as a component of SUSE Linux Enterprise Server 15-LTSS p7zip as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 p7zip as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process. CVE-2023-52169 SUSE Enterprise Storage 7.1:p7zip-16.02-150200.14.12.1 SUSE Enterprise Storage 7.1:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:p7zip-doc-16.02-150200.14.12.1 SUSE Linux Enterprise Server 12 SP3-LTSS-TERADATA:p7zip-9.20.1-7.6.1 SUSE Linux Enterprise Server 12 SP3-TERADATA:p7zip-9.20.1-7.6.1 SUSE Linux Enterprise Server 12 SP5:p7zip-9.20.1-7.6.1 SUSE Linux Enterprise Server 15 SP2-LTSS:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Server 15 SP2-LTSS:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Server 15 SP3-LTSS:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Server 15 SP3-LTSS:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Server 15 SP4-LTSS:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Server 15 SP4-LTSS:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Server 15 SP4-TERADATA:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Server 15 SP4-TERADATA:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:p7zip-9.20.1-7.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:p7zip-full-16.02-150200.14.12.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:p7zip-16.02-150200.14.12.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:p7zip-full-16.02-150200.14.12.1 SUSE Manager Proxy 4.3:p7zip-16.02-150200.14.12.1 SUSE Manager Proxy 4.3:p7zip-full-16.02-150200.14.12.1 SUSE Manager Retail Branch Server 4.3:p7zip-16.02-150200.14.12.1 SUSE Manager Retail Branch Server 4.3:p7zip-full-16.02-150200.14.12.1 SUSE Manager Server 4.3:p7zip-16.02-150200.14.12.1 SUSE Manager Server 4.3:p7zip-full-16.02-150200.14.12.1 openSUSE Leap 15.5:p7zip-16.02-150200.14.12.1 openSUSE Leap 15.5:p7zip-doc-16.02-150200.14.12.1 openSUSE Leap 15.5:p7zip-full-16.02-150200.14.12.1 openSUSE Leap 15.6:p7zip-16.02-150200.14.12.1 openSUSE Leap 15.6:p7zip-doc-16.02-150200.14.12.1 openSUSE Leap 15.6:p7zip-full-16.02-150200.14.12.1 important 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H