quick_snail@feddit.nl 3 days ago
That actually doesn’t seem to be so severe.
How many people download some random archive and then, after extracting it, they double click on the files inside it?
It says the risk of this vuln is arbitrary code execution of a maliciously crafted archive.
After fixing this bug, most 7zip users will still be vulnerable to arbitrary code execution due to maliciously crafted archives.
SteleTrovilo@beehaw.org 3 days ago
According to the last paragraph, the vulnerability is in reading the archive itself, not the decompressed contents.
Kactus@piefed.world 3 days ago
I think what quick snail is saying is that if you are going to download a malicious zip file you are just as likely to unzip the archive and run the program inside. It’s a lot easier to just have a malicious payload inside the archive.