Bug extracting from ZIP etc using Extract here with PA 22.00.09

[BigMike]

Hi there,

there were some security issues fixed in 7zip:
https://www.zerodayinitiative.com/advisories/ZDI-23-1165/
https://www.zerodayinitiative.com/advisories/ZDI-23-1164/

As it seems, that PowerArchiver and PACL use the 7zip libraries, could you please update them to the latest version?

[ZebraPower]

I’m not so sure this project isn’t dead, or on life support. – or at best the forums are simply neglected. You typically do get a response, but often days or weeks go by.

You may want to try sending a ticket in or something from their main website. Some one else suggested that.

[trparky]

@ZebraPower said in Security vulnerabilities in 7zip / Update for PowerArchiver and PACL libraries?:

I’m not so sure this project isn’t dead, or on life support. – or at best the forums are simply neglected. You typically do get a response, but often days or weeks go by.

You may want to try sending a ticket in or something from their main website. Some one else suggested that.

Tell me about it, it truly feels like the lights are on but nobody’s home. I’d really suggest people to choose a different program for their compression needs because this software is effectively dead.

[spwolf]

thank you, logged in for fixing.

[Brian Gregory]

For anyone who is worried by this, it’s not hard to extract the DLLs in question from the latest 7-zip executables and replace them yourself. You need the two latest installer EXE files for 7-zip, the x86 one and the x64 one. At the time of writing, they are 7z2301-x64.exe and 7z2301.exe.

You can use PowerArchiver to get the contents of the exe file out without actually installing them. I use a right click drag and choose “Extract To” on the resulting menu. This makes a folder containing the contents of the EXE. In the resulting folders the files required are called 7z.dll. You need them both, the one from the 64 bit version needs to be renamed to 7x64.dll.

As an alternative, you could just open the EXE files with PowerArchiver, telling the open dialog to show “All Files” so you can see and choose EXE files. Once a 7-zip installer EXE is open in PowerArchiver drag 7z.dll out to some folder. The one from the 64 bit version needs to be renamed to 7x64.dll, so I suggest doing that one first and immediately renaming it, then you can keep them together in the one folder.

You should end up with a new 7z.dll and 7z64.dll.

Then you just need to use them to replace the old ones in your PowerArchiver and/or PACL directories. (e.g. C:\Program Files\PowerArchiver) I suggest renaming the old ones by adding old or .old to their filenames before copying in the new files, just in case something has gone wrong.

[BigMike]

@Brian-Gregory Thank you for the tip.