While researching vulnerabilities on 7-zip, I noticed that there is a code execution vulnerability. I wanted to convey it to you. You can access the related video below
So do you know exact line of bug in 7-zip source code?
And you don't point me it intentionally?
Why?
Do you think that it's good practice to hide full information about possible vulnerability from developer of software?
When you'll disclose details of bug and whom?
Last edit: Igor Pavlov 5 days ago
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I'm being honest with you. Actually, I'm trying to find another vulnerability on 7-zip software, and it's happening again with heap-overflow. If I tell you which file is in the source code and on which line, you will close the vulnerability. I am a hacker. I'm evaluating and I don't want to say because I make money from this business. I won and I'm just telling you how to turn it off from the interface. If there is no access to hh.exe from the interface, there is nowhere to trigger anyway. I don't intend to reveal the details of the vulnerability because that's the way I am selling it.
1
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
So do you know exact line of bug in 7-zip source code?
And you don't point me it intentionally?
Why?
Do you think that it's good practice to hide full information about possible vulnerability from developer of software?
When you'll disclose details of bug and whom?
Last edit: Igor Pavlov 5 days ago
I'm being honest with you. Actually, I'm trying to find another vulnerability on 7-zip software, and it's happening again with heap-overflow. If I tell you which file is in the source code and on which line, you will close the vulnerability. I am a hacker. I'm evaluating and I don't want to say because I make money from this business. I won and I'm just telling you how to turn it off from the interface. If there is no access to hh.exe from the interface, there is nowhere to trigger anyway. I don't intend to reveal the details of the vulnerability because that's the way I am selling it.