Skip to main content

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2024-11612

Medium
6.5/10

Summary

7-Zip CopyCoder contains an Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a Denial-of-Service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. Specific flaws exist within the processing of streams. The issue results from a logic error that can lead to an infinite loop. It was assigned to ZDI-CAN-24307. This vulnerability affects 7zip package versions prior to 24.08.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-835 - Loop with Unreachable Exit Condition

Loops with multiple exits and flags detract from the quality of an application. They tend to make control structures difficult to understand, and introduce the risk of non-termination and other structural problems. The vulnerability “loop with unreachable exit condition” enables attackers to exploit this flaw, leading to denial of service.

References

Advisory Timeline

  • Published