c/cybersecurity · by kid@sh.itjust.works · 1y

7-Zip Zero-Day Exploit Allegedly Leaked Online

https://cybersecuritynews.com/7-zip-zero-day-exploit/

48 points · 3 comments · view on lemmy.world

3 Comments

themelm@sh.itjust.works · 24 pts · 1y (2 replies)

The dev appears to think this is a fake exploit generated by LLM/AI

https://sourceforge.net/p/sevenzip/bugs/2539/

wizardbeard@lemmy.dbzer0.com · 7 pts · 1y (1 reply)

Based off a small technicality with one of the comments in the code. The "function" referenced is actually a macro.

HackerJoe@sh.itjust.works · 4 pts · 1y

It's nonsense:

https://xcancel.com/Seifreed/status/1874245336291488179

The LZMA implementation already validates bounds elsewhere (bufLimit). If p->buf exceeds its limit, the program aborts the decompression safely.
🚫 The claim of unchecked memory access is baseless.