{"id":"UBUNTU-CVE-2016-9296","details":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","modified":"2025-07-16T08:19:56.630949Z","published":"2016-11-12T02:59:00Z","withdrawn":"2025-07-18T16:43:40Z","upstream":["CVE-2016-9296"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2016-9296"},{"type":"REPORT","url":"https://sourceforge.net/p/p7zip/bugs/185/"},{"type":"REPORT","url":"https://github.com/yangke/7zip-null-pointer-dereference"},{"type":"REPORT","url":"https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2016-9296"}],"affected":[{"package":{"name":"p7zip","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/p7zip@16.02+dfsg-6?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02+dfsg-6"}]}],"versions":["16.02+dfsg-4","16.02+dfsg-5"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"p7zip","binary_version":"16.02+dfsg-6"},{"binary_name":"p7zip-dbgsym","binary_version":"16.02+dfsg-6"},{"binary_name":"p7zip-full","binary_version":"16.02+dfsg-6"},{"binary_name":"p7zip-full-dbgsym","binary_version":"16.02+dfsg-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-9296.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]}