PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2024-11477- 7-Zip ZSTD Buffer Overflow Vulnerability

crowdfense.com | vulnerability | CVE-2024-11477 | #vulnerability-analysis | #buffer-overflow | #out-of-bounds | #cve-2024-11477 | #7-zip | #zstd | #decompression
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Technical analysis of CVE-2024-11477, an out-of-bounds read in 7-Zip's ZSTD decompression that stems from missing bounds checks on literals/match length codes and can escalate into a heap overflow.
CVE
CVE-2024-11477
Published
Collected

Related coverage

vulnerability · bishopfox.com
Signature Optional - Analysis of CVE-2026-28323
CVE-2026-28323 is a CVSS 9.8 SAML auth bypass in SolarWinds Web Help Desk. A single forged POST request grants unauthenticated access to any valid account.
vulnerability · blog.quarkslab.com
Beware the Bad Neighbor: Analysis and PoC of the Windows IPv6 Router Advertisement Vulnerability (CVE-2020-16898)
Analysis and PoC of CVE-2020-16898 Bad Neighbor, a stack-based buffer overflow in the Windows IPv6 stack triggered by a malformed Router Advertisement, allowing potential remote code execution.
vulnerability · yeswehack.com
Log4Shell, Ten Days On: YesWeHack’s Hunters Are at the Forefront of Securing Organisations
Ten days after Log4Shell, YesWeHack explains why the ubiquitous Log4j library became the internet's Achilles' heel and how its hunter community helped organisations respond to the fallout.
vulnerability · bugcrowd.com
Big Bugs | Episode 5: Big XSS–Not an Oxymoron
Big Bugs Episode 5 argues that 'big XSS' is not an oxymoron: though XSS is often dismissed as low-hanging fruit, exploit chains show it can drive ransomware and full account takeover.
High · vulnerability · github.com
MySQL Community Server 26.7.0 mysqldump SHOW TABLES Stack Buffer Overflow
Demonstrates client-side trust assumptions in the MySQL protocol, enabling rogue database servers to crash backup clients and potentially exploit operators running mysqldump.
vulnerability · netspi.com
CVE-2026-78902: XSS to RCE in pfSense with one DNS request
NetSPI reports CVE-2026-78902, a stored cross-site scripting issue in the pfSense pfBlockerNG package that can be escalated to remote code execution with a single DNS request.
Back