Abstract

Denial-of-service (DoS) vulnerabilities due to Heap-based Buffer Overflow (CWE-122) and NULL Pointer Dereference (CWE-476), an information tampering vulnerability due to Improper Link Resolution Before File Access ('Link Following') (CWE-59), and a malicious code execution vulnerability due to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) exist in the 7-Zip component, the file compression/decompression software included in MELSOFT Update Manager.