7-Zip v18.05

[Arthur]

Website / Download (64-bit: EXE, MSI / 32-bit: EXE, MSI) / Changelog

 

• The speed for LZMA/LZMA2 compressing was increased
  
  • by 8% for fastest/fast compression levels and
    
  • by 3% for normal/maximum compression levels.
    

  [*]7-Zip now shows Properties (Info) window and CRC/SHA results window as "list view" window instead of "message box" window.

  [*]Some improvements in zip, hfs and dmg code.

  [*]Previous versions of 7-Zip could work incorrectly in "Large memory pages" mode in Windows 10 because of some BUG with "Large Pages" in Windows 10.

  • Now 7-Zip doesn't use "Large Pages" on Windows 10 up to revision 1709 (16299).
    

  [*]The vulnerability in RAR unpacking code was fixed (CVE-2018-10115).

  [*]Some bugs were fixed.

 

To silently install/uninstall EXE installer use the following commands.

 

7z1805-x64.exe /S

 

"%ProgramFiles%\7-Zip\Uninstall.exe" /S

[Arthur]

https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-execution

 

In the previous post on the 7-Zip bugs CVE-2017-17969 and CVE-2018-5996, I mentioned the lack of DEP and ASLR in 7-Zip before version 18.00 (beta). Shortly after the release of that blog post, Igor Pavlov released 7-Zip 18.01 with the /NXCOMPAT flag, delivering on his promise to enable DEP on all platforms. Moreover, all dynamic libraries (7z.dll, 7-zip.dll, 7-zip32.dll) have the /DYNAMICBASE flag and a relocation table. Hence, most of the running code is subject to ASLR.

 

However, all main executables (7zFM.exe, 7zG.exe, 7z.exe) come without /DYNAMICBASE and have a stripped relocation table. This means that not only are they not subject to ASLR, but you cannot even enforce ASLR with a tool like EMET or its successor, the Windows Defender Exploit Guard.

 

Obviously, ASLR can only be effective if all modules are properly randomized. I discussed this with Igor and convinced him to ship the main executables of the new 7-Zip 18.05 with /DYNAMICBASE and relocation table. The 64-bit version still runs with the standard non-high entropy ASLR (presumably because the image base is smaller than 4GB), but this is a minor issue that can be addressed in a future release.

 

On an additional note, I would like to point out that 7-Zip never allocates or maps additional executable memory, making it a great candidate for Arbitrary Code Guard (ACG). In case you are using Windows 10, you can enable it for 7-Zip by adding the main executables 7z.exe, 7zFM.exe, and 7zG.exe in the Windows Defender Security Center (App & browser control -> Exploit Protection -> Program settings). This will essentially enforce a W^X policy and therefore make exploitation for code execution substantially more difficult.

 

[...]

 

Fortunately, the new 7-Zip 18.05 not only resolves the bug, but also comes with enabled ASLR on all the main executables.

[Arthur]

18.06 has been released.

 

Website / Download (64-bit: EXE, MSI / 32-bit: EXE, MSI) / Changelog

 

* The speed for LZMA/LZMA2 compressing was increased by 3-10%, and there are minor changes in compression ratio.
* Some bugs were fixed.
* The bug in 7-Zip 18.02-18.05 was fixed: there was memory leak in xz decoder.
* 7-Zip 18.02-18.05 used only one CPU thread for bz2 archive creation.