New 7-Zip version 19.00

Topic

New Reply

Igor Pavlov just released a new version of 7-Zip. He’s bumped the version number up from 18.06 to 19.00. Details coming from OlderGeeks.com.
[See the full post at: New 7-Zip version 19.00]

9 users thanked author for this post.

Morty, mrj2k, abbodi86, Great Lake Bunyip, ve2mrx, PhotM, TJ, SueW, JohnW

Reply | Quote

Replies

Change log here: https://www.7-zip.org/history.txt

Discovered that I was still running 18.01, yikes!

Thanks for the heads-up!!!

Windows 10 Pro 22H2

3 users thanked author for this post.

ve2mrx, Lars220, SueW

Reply | Quote

OlderGeeks.com only mentions the 32-bit version of 7-Zip. There is a 64-bit version too. See 7-Zip at sourceforge[/url].

--Joe

2 users thanked author for this post.

Morty, BATcher

Reply | Quote

The 64-bit version is also available on the 7-zip.org download site.

1 user thanked author for this post.

Morty

Reply | Quote

Yep. Even though the title for the download box is currently incorrect the download links are for version 19.00

Oops. Dumb me. That is just the date. Sorry for my confusion,

--Joe

Reply | Quote

I shoulda mentioned that the copy on OlderGeeks is 64-bit.

There are separate 32-bit and 64-bit EXEs available on the 7-Zip site.

I should also warn people – 7-Zip is free, and the downloaded file from official sites doesn’t have any cr*pware side-installations. Get it from OlderGeeks, the 7-Zip site, or from Sourceforge.

4 users thanked author for this post.

Morty, Great Lake Bunyip, Lars220, SueW

Reply | Quote

7-Zip works in Windows 10 / 8 / 7 / Vista / XP / 2016 / 2012 / 2008 / 2003 / 2000 / NT.

WoW! such an array of compatable OS versions..how I miss Windows 2000

Windows - commercial by definition and now function...

Reply | Quote

Hey all, couple of questions regarding 7-Zip.

On my windows 7 computer, I installed PowerArchiver many years ago and it works well. However it installed hundreds of file extensions in my registry which I never use and even they didnt know how to remove them!

So for my newer windows 10 computer, I am looking for something with a little lighter installation profile.

Does 7- zip install a bunch of file extensions?

For me, I need a program that can  extract multiple files from multiple .zip files/folders at the same time (ex: 10 .zip files/folders with each .zip file containing say 50 .docx or .jpg files. Highlight all 10 .zip and open/extract all files simultaneously).  Can 7-zip do this?

Windows 10 Pro x64 v22H2 and Windows 7 Pro SP1 x64 (RIP)

Reply | Quote

• 7-Zip is very light, and doesn’t take up much disk space.
• No 7-Zip doesn’t automatically add file associations, you will have to launch the file manager using an account with Administrator privileges to add or change them. (What I have not tried is file association with a standard account using the usual dialog interface method.)
• I have not tried opening multiple archives, but 7-Zip can test many selected archives in sequence so it may do multiple separate archive extraction.  Have fun testing 7-Zip!

Reply | Quote

I have tested selecting multiple archives in Explorer and 7-Zip will extract all the archives in one run.

Reply | Quote

Hey Woody, back in March 2018 you were asking if it might be time to give up on 7-Zip due to multiple security vulnerabilities and concerns with it:  https://www.askwoody.com/2018/is-it-time-to-give-up-on-7-zip/

Does this new version 19.00 address all those concerns?  Are you comfortable with using it now — and recommending it again?

6 users thanked author for this post.

Morty, SueW, Microfix, EspressoWillie, Great Lake Bunyip, ve2mrx

Reply | Quote

These security issues were addressed in these Forums at the time and a bit later, as well as by Woody at ComputerWorld:

Multiple vulnerabilities in 7-Zip. Get it updated now!

https://www.computerworld.com/article/3252031/multiple-vulnerabilities-in-7-zip-get-it-updated-now.html 

The new version has further security and stability and feature improvements:

https://www.7-zip.org/history.txt

For Linux users, there’s an upgrade to PeaZip in alignment with these changes:

http://www.peazip.org/changelog.html#latest_software_release

http://www.peazip.org/peazip-linux.html

 

-- rc primak

1 user thanked author for this post.

Morty

Reply | Quote

rc primak wrote:

These security issues were addressed in these Forums at the time and a bit later, as well as by Woody at ComputerWorld:

Multiple vulnerabilities in 7-Zip. Get it updated now! https://www.computerworld.com/article/3252031/multiple-vulnerabilities-in-7-zip-get-it-updated-now.html

 

The new version has further security and stability and feature improvements: https://www.7-zip.org/history.txt

That ComputerWorld article pre-dates the March 2018 security concerns by more than a month.

Which version addressed the ASLR and /GS concerns?

Reply | Quote

18.05, apparently.

1 user thanked author for this post.

rc primak

Reply | Quote

If you launch 7-zip 19.00 and then open Process Explorer by Sysinternals, you will see that ASLR is enabled.

Windows 10 Pro 22H2

2 users thanked author for this post.

rc primak, b

Reply | Quote

Just from my experience and fairly random readings at tech sites other than here, I can tell you that Version 18.05 addressed the ASLR and one other security issues.  It’s true the Changelog notes at the official 7-ZIP website are not clear about these issues. But Pavlov has said in interviews that he did relent and 7-ZIP now includes mitigations for these issues.

-- rc primak

Reply | Quote

Just something I stumbled across yesterday. One computer was using the portable version so I decided to install v 19 and remove the portable version.

When I went to unrar something, I had no 7-zip right click menu items. That has never happened. So I went searching and discovered I had to run the exe file as an administrator. I downloaded again, this time running the install as an admin to get the right click menu back.

I don’t think in the past versions I had to do this.

Got coffee?

Reply | Quote

I believe it was the Windows shell extension (context menu) that raised the initial questions about the potential for a security risk.

I always assumed that 7-zip by itself without the shell was secure now.

I don’t know if the shell extension feature was ever hardened. The author apparently didn’t think that was necessary at the time the original question was raised.

[7-Zip’s] INSECURE shell extension is loaded into explorer.exe

Original articles here:

https://www.askwoody.com/2018/is-it-time-to-give-up-on-7-zip/

https://www.computerworld.com/article/3252031/microsoft-windows/multiple-vulnerabilities-in-7-zip-get-it-updated-now.html

Windows 10 Pro 22H2

1 user thanked author for this post.

rc primak

Reply | Quote

The issues that Woody raised back in March 2018 were these:

The core of the problem: Pavlov refuses to add ASLR (Address Space Layout Randomization) to the product, and won’t compile 7-Zip with the /GS Buffer Security Check flag.

So I would think that the questions now should be these:  (1) Does version 19.00 add ASLR?  And (2) Has version 19.00 been compiled with the /GS flag?

I haven’t seen anyone directly address those two questions yet about this new 7-Zip version.

2 users thanked author for this post.

rc primak, EspressoWillie

Reply | Quote

That’s probably a good question to ask.

But I haven’t been too concerned since I mainly use 7-zip archives that were created by me.

For regular zip file archives that I download, I always use the built-in Windows extractor.

Windows 10 Pro 22H2

Reply | Quote

So I can’t find anything on 7-zip’s site about the two issues back from March 2018.  It’s been mentioned a couple of times here but no answer.  Is someone in communication with Pavlov that can answer these questions? And what is really affected by these issues again?

Thanks!!

Cheers!!
Willie McClure
“We are trying to build a gentler, kinder society, and if we all pitch in just a little bit, we are going to get there.” Alex Trebek

Reply | Quote

My references to the Changelogs mention exactly the CVEs which were of concern. Yes, the ASLR issues were finally changed after Pavlov relented. I use the Portable Versions for Windows and Linux. Simpler for me. But, no Shell Integration. Better in Ubuntu with Gnome and Wayland, but not so much if you like the context Menu items in Windows.

-- rc primak

Reply | Quote

rc primak wrote:

My references to the Changelogs mention exactly the CVEs which were of concern. Yes, the ASLR issues were finally changed after Pavlov relented.

There’s only a single CVE mentioned in the https://www.7-zip.org/history.txt to which you linked, which concerns RAR unpacking.

Where were the ASLR issues addressed?

Where did you see that he relented?

Reply | Quote

I guess it was addressed by 18.05 at the same time as the RAR CVE, even though ASLR is not mentioned in the history.txt:

Obviously, ASLR can only be effective if all modules are properly randomized. I discussed this with Igor and convinced him to ship the main executables of the new 7-Zip 18.05 with /DYNAMICBASE and relocation table.
https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-execution/

1 user thanked author for this post.

rc primak

Reply | Quote

Yeah, the Changelog was terribly unclear about exactly what they had patched, and what effect it had on 7-ZIP’s security status. But Pavlov himself has told tech site reporters that the two vulnerabilities were addressed as of Version 18.05. Sorry if this is confusing, but the guy (Pavlov) is notoriously hard to pin down on security issues.

-- rc primak

Reply | Quote

Get 7-zip from Ninite.com. That’s what I use; no cr*pware or anything, and you just run the installer to install or update the program. Only caveat is that it will always install in the default directory.

Reply | Quote

I just use the Portable version directly from the 7-ZIP download site. That way all I have to do is blow away the folder and start over with each new version. Of course, this means I haven’t got the Windows Shell Extension and the right-click menu item.

Part of the reason I favor Windows utilities in portable versions is that I also run Linux. In Linux, AppImages and Portable Apps are very common. Both methods reduce greatly the Linux issue of lacking needed dependencies.  Replacing an AppImage in Linux is nearly the same as replacing a Portable App in Windows. But AppImages take up a lot more disk space than installed applications, and can have redundant dependencies in the package.

-- rc primak

Reply | Quote

rc primak wrote:

I just use the Portable version directly from the 7-ZIP download site.

Where on the 7-zip site can you find the Portable version directly?  All I can find is the installable version.  For portable, everyone seems to direct to Portable Apps site.

Thanks

Windows 10 Pro x64 v22H2 and Windows 7 Pro SP1 x64 (RIP)

Reply | Quote

is it safe already to install this new version 19.00 over 18.06? or should i wait?

Reply | Quote

Yes you can overwrite the older 7-Zip version.

Reply | Quote

Why install 7-zip when you can use the portable version ?

1 user thanked author for this post.

rc primak

Reply | Quote

That could also be said of a lot of utilities.
You struck a chord for me there as none of the utilities I use are actually installed in Windows.

Windows - commercial by definition and now function...

1 user thanked author for this post.

rc primak

Reply | Quote

Why install 7-zip when you can use the portable version ?

It adds the right-click menu item to File Explorer for those who use compression frequently.

-- rc primak

Reply | Quote

Where can I get the 7-zip portable version for Windows 10 (ver 19.00 x64)?

Can you confirm it makes minimal registry entries?

Thanks

Windows 10 Pro x64 v22H2 and Windows 7 Pro SP1 x64 (RIP)

Reply | Quote

See https://portableapps.com/apps/utilities/7-zip_portable.

--Joe

1 user thanked author for this post.

columbia2011

Reply | Quote