SUSE alert openSUSE-SU-2026:21038-1 (7zip)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21038-1: important: Security update for 7zip
Date:
             
 
Tue, 30 Jun 2026 09:48:02 +0200
Message-ID:
             
 
<20260630074802.B924FFF49@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for 7zip
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21038-1
Rating: important
References:

  * bsc#1267421
  * bsc#1267858
  * bsc#1267859
  * bsc#1267860
  * bsc#1267861
  * bsc#1267862
  * bsc#1267863
  * bsc#1267864



Cross-References:

  * CVE-2026-48092
  * CVE-2026-48095
  * CVE-2026-48101
  * CVE-2026-48102
  * CVE-2026-48103
  * CVE-2026-48104
  * CVE-2026-48111
  * CVE-2026-48112



CVSS scores:

  * CVE-2026-48092 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  * CVE-2026-48092 ( SUSE ): 6.7 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-48095 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-48101 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  * CVE-2026-48101 ( SUSE ): 6.7 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-48102 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
  * CVE-2026-48102 ( SUSE ): 2.1 CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-48103 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
  * CVE-2026-48103 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-48104 ( SUSE ): 3.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
  * CVE-2026-48104 ( SUSE ): 1.8 CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-48111 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
  * CVE-2026-48111 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-48112 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
  * CVE-2026-48112 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 8 vulnerabilities and has 8 bug fixes can now be installed.

Description:

This update for 7zip fixes the following issues

Update to 26.01:

- CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure
(bsc#1267858).
- CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation
(bsc#1267421).
- CVE-2026-48101: Information Disclosure via uninitialized memory in UEFI capsule parser
(bsc#1267859).
- CVE-2026-48102: Information disclosure and denial of service via crafted UDF image
(bsc#1267860).
- CVE-2026-48103: off-by-one heap out-of-bounds read (bsc#1267861).
- CVE-2026-48104: Uninitialized heap read in SquashFS archive handler (bsc#1267862).
- CVE-2026-48111: off-by-one out-of-bounds read in ParseDepedencyExpression function
(bsc#1267863).
- CVE-2026-48112: heap out-of-bounds read in BSD SYMDEF parser (bsc#1267864).

Changes:

 * linux version of 7-Zip can use huge pages (2 MB pages). It can
 increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
 * new -spo[d|c|r] switch specifies the path generation mode for
 the output directory for archive extraction. The output directory
 path is generated from the path specified in the -o{dir_path}
 switch and the name of the archive being unpacked.
 -spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct
 path to the output directory. The asterisk (*) character
 in {dir_path} will not be replaced by the archive name.
 -spoc : 7-Zip will concatenate the path specified in -o{dir_path}
 with the archive name to form the final path to the output
 directory.
 -spor : 7-Zip will replace asterisk (*) character in the path
 specified in the -o{dir_path} with the archive name.
 This is the default option.
 * some bugs were fixed.
- Update to 26.00:
 * improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.
 * 7-Zip File Manager: improved sorting order of the file list.
 It uses file name as secondary sorting key.:
 * 7-Zip File Manager: improved Benchmark to support systems with more than
 64 CPU threads.
 * bug fixed: 7-Zip could not correctly extract TAR archives containing sparse
 files


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1051=1

Package List:

- openSUSE Leap 16.0:

  7zip-26.01-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-48092.html
  * https://www.suse.com/security/cve/CVE-2026-48095.html
  * https://www.suse.com/security/cve/CVE-2026-48101.html
  * https://www.suse.com/security/cve/CVE-2026-48102.html
  * https://www.suse.com/security/cve/CVE-2026-48103.html
  * https://www.suse.com/security/cve/CVE-2026-48104.html
  * https://www.suse.com/security/cve/CVE-2026-48111.html
  * https://www.suse.com/security/cve/CVE-2026-48112.html