The current version 16.02_1 has a critical vulnerability. https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-execution/ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897674 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-10115
I'm aware of the vulnerability, the problem is that upstream is half-dead/unresponsive: while 7zip itself has been patched, the p7zip project only has a huge, unreviewed user-submitted patch: https://sourceforge.net/p/p7zip/discussion/383043/thread/5dd56271/ Given this bug doesn't affect Fedora and openSUSE, and neither Arch Linux not Debian have incorporated that patch, I'm hesitant to be the first one to do that.
https://sources.debian.org/src/p7zip-rar/16.02-3/debian/patches/CVE-2018-10115.patch/ Debian has a patch
what is the current status? Does ports-secteam have to be active here?
This slipped through the cracks while I had very little time for FreeBSD... I took a look at this today, and I think the Debian patch can be improved. I've posted a new version to the Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897674#15 and would like to wait for some feedback before committing a fix to the tree.
can we close here?