FEDORA-2026-f36864b408 — security update for 7zip

stable

7zip-26.01-1.fc43

FEDORA-2026-f36864b408 created by salimma a month ago for Fedora 43

Fixes CVE-2026-48092: Information disclosure in 32-bit builds
Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF image
Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive handler
Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive handler
Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image parser
Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD SYMDEF parser

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-f36864b408

This update has been submitted for testing by salimma.

a month ago

This update's test gating status has been changed to 'waiting'.

a month ago

dcavalca provided feedback a month ago

karma

BZ#2373874 7z cannot find library when invoked with full path: Codec Load Error: /usr/bin/7z.so : errno=2 : No such file or directory

BZ#2433842 7zip: FTBFS in Fedora rawhide/f44

BZ#2478240 7zip: `/bin/7z` fails to load codecs when `/bin` is a symlink to `/usr/bin`

BZ#2485479 CVE-2026-48092 7zip: 7-Zip: Information disclosure in 32-bit builds due to heap memory disclosure [fedora-all]

BZ#2485481 CVE-2026-48095 7zip: 7-Zip: Arbitrary code execution via heap buffer overflow in NTFS handler [fedora-all]

BZ#2485489 CVE-2026-48102 7zip: 7-Zip: Information disclosure and denial of service via crafted UDF image [fedora-all]

BZ#2485492 CVE-2026-48101 7zip: 7-Zip: Information Disclosure via uninitialized memory in UEFI capsule parser [fedora-all]

BZ#2486337 CVE-2026-48103 7zip: off-by-one heap-based buffer over-read in the WIM archive handler [fedora-all]

BZ#2486339 CVE-2026-48104 7zip: uninitialized heap read in the SquashFS archive handler [fedora-all]

BZ#2486344 CVE-2026-48111 7zip: off-by-one out-of-bounds read in the UEFI firmware image parser [fedora-all]

BZ#2486347 CVE-2026-48112 7zip: heap-based buffer over-read in the Ar handler BSD SYMDEF parser [fedora-all]

This update's test gating status has been changed to 'passed'.

a month ago

rathann commented & provided feedback a month ago

karma

Creating an archive and unpacking files from an archive works.

This update has been submitted for stable by bodhi.

a month ago

This update has been pushed to stable.

a month ago

Please log in to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

14 days

Dates

submitted

a month ago

in stable

a month ago

approved

a month ago

Builds