It was reported [1] that p7zip suffers from a directory traversal flaw. This could for the overwriting of arbitrary files through uncompressing a crafted archive, with the privileges of the user running 7z. For example: $ ln -s /tmp foo $ 7z a test.7z foo $ rm foo $ mkdir foo $ echo hello > foo/test $ 7z a test.7z foo/test $ rm -rf foo $ 7z x test.7z This will create 'foo' as a symlink to /tmp which will in turn contain the file 'test' with the privileges of the user unarchiving 'test.7z'. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660
p7zip-15.09-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
p7zip-15.09-4.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
p7zip-15.09-9.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
p7zip-15.09-9.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.