WinRAR: baixar versions anteriors

1. Heap overflow vulnerability is fixed in RAR5 recovery volume
data reconstruction code. It affects WinRAR, RAR and UnRAR.
UnRAR.dll library doesn't include recovery volume processing,
so it is not affected.

We are thankful to Arjun Basnet from Securin Labs for letting us know
about this security issue.

2. Symbolic link pointing outside of destination folder could be created
even without -ola switch, when extracting a specially crafted
RAR archive by WinRAR, RAR, UnRAR or UnRAR.dll library.

Further check in extraction code prevents placing files to such folder
even in case of multiple extraction commands, excluding the possibility
of path traversal attack for WinRAR, RAR or UnRAR based extraction.
It limits the potential threat to a case where another tool uses this
symbolic link to store files.

We are thankful to scofaild23-bnomran for letting us know about this
security issue.

3. 7zxa.dll 7z extraction library is updated to version 26.02 to include
bug and vulnerability fixes by the library developer.

4. Switch -iver prints RAR version even if -idc is specified
in the command line, configuration file or RARINISWITCHES environment
variable. Previously -idc blocked -iver action.

Also a new line character is added to -iver output.

1. Deleting from solid archives reverted to pre-7.20 state to finalize
the fix in WinRAR 7.21 and avoid potential checksum errors.

1. WinRAR properly recognizes archives with a wrong file extension,
containing an archive in another format stored without compression.

For example, if host.rar, storing nested.zip inside, was renamed to
host.zip, WinRAR 7.20 could display nested.zip contents when opening
such host.zip. This version displays host.zip contents.

2. Similarly to Windows Explorer, the first click on size and time columns
in WinRAR file list sets the reverse sort mode with largest and latest
files at the top.

3. Switch -s=e performs the case insensitive file extension comparison
in Windows. Unlike previous versions, solid statistics isn't reset
anymore for file extensions differing only by case.

4. If self-extracting archive attempts to extract files to a folder
requring administrator rights and elevation prompt is cancelled by user,
the archive quits silently instead of issuing the folder access error.

5. Bugs fixed:

a) WinRAR 7.20 could produce a broken archive when deleting files from
solid archives in old RAR4 format. As a result of this fix, deleting
files in solid RAR4 archives now involves the full archive repacking,
similar to WinRAR versions preceding 7.20. It doesn't affect archives
in the modern RAR5 format;

b) with a rare combination of source data type and compression
parameters, WinRAR 7.x could crash when compressing source data.
Such crash was more likely when processing large amount of poorly
compressible data;

c) WinRAR 7.20 couldn't unpack ZIP archives containing file comment
fields;

d) switch -tl didn't set the latest time when used with RAR 7.20
"ch" command;

e) extraction command didn't automatically replace device names
like "aux", when unpacking archives containing such reserved names;

f) if folder shortcut was double clicked in "Save WinRAR settings as"
dialog when exporting WinRAR settings, folder shortcut itself was
overwritten with settings data instead of opening a target folder.

1. Performance improvements when deleting files in solid RAR archives:

a) if there are no non-zero files after deleted files, archive
recompressing isn't performed;

b) part of archive before deleted files is copied as is, without
repacking. Its contents is unpacked to memory if necessary,
but not recompressed;

c) semi-solid archive processing involves only solid blocks containing
deleted files. Unaffected solid blocks are copied as is.

2. "Generate archive name by mask" archiving option and -ag command line
switch:

a) new 'K' format character defines the current day of week
name as a text string;

b) new 'O' format character defines the current month name as a text
string regardless of format character number. Unlike "MMM" mask,
it allows to use shorter or longer than 3 character names,
such as -agOO;

c) excessive format characters exceeding the available field width
are now ignored instead of appending to archive name.
So it is possible to use full month or week day names by providing
format characters in the amount equal or exceeding the longest name,
such as -agKKKKKKKKKK for day of week names.

3. Command line -s switch:

a) switch -s accepts the optional parameter preceded by '=' character.

Switches -s, -se, -sv, -sv-, -s- are replaced by -s=f, -s=e,
-s=v, -s=d, -s=-. Previous versions of these switches are still
supported in the current version, but can be removed in the future.

It is allowed to combine multiple modifiers in the same switch,
such as -s=e100f.

b) new switch -s=r resets the solid statistics before adding new files
to existing archive.

4. Switch -tk now accepts the optional date parameter in YYYYMMDDHHMMSS
format. If used without parameter when modifying an archive,
it preserves the original archive time. If optional parameter
is present, it is assigned to archive modification time.

It is allowed to insert separators like '-' or ':' to the date string
and omit trailing fields. For example, switch -tk2025-06-01 is correct.

5. "Specified time" is added to "Set archive time to" options on "Time"
page of archiving dialog. It allows to assign the manually entered time
to newly created or modified archives.

6. UTF-8 output format and byte order mark options are added to
"Generate report" command.

7. "Cloud files" option is added to "Where to check for SFX archives"
group in "Settings/Integration/Context menu items..." dialog.

If this option is off, WinRAR shell extension will not attempt
to detect if archive is self-extracting, when right clicking
an executable cloud file not available locally. This detection
involves data read and can be slow for such files.

This option relies on file attributes returned by a cloud storage
provider and can be ignored if required attribute isn't supported
by specific cloud service.

8. "Copy to clipboard" button at the bottom of "Search results" dialog
places current results of "Find files" command to clipboard.

9. It takes less time to open a large archive with a lot of files
and folders in WinRAR file list. This is most noticeable for ZIP
archives containing millions of files.

10. Improved extraction speed of TAR and TAR based archives,
such as .tar.gz or tar.xz. It is most visible for hard disk drives
with slower seek time and large archives containing a lot of files.

11. SFX module sets sfxnamenoext environment variable, containing
SFX archive name without path and extension. It allows to append
the archive name to user defined destination path like:

Path=c:\Util\%sfxnamenoext%"

12. "minsize" parameter, defining the minimum file reference size
in -oi[0-4][:] switch, now can include an optional trailing
unit size character. So -oi:1m is the equivalent of -oi:1048576.

13. Switch -x recognizes exclude paths with both Windows and Unix style
path separators, so -xfolder\file and -xfolder/file do the same.
Previously only -xfolder\file excluded the file.

14. Bugs fixed:

a) "Files to exclude" field of archiving dialog was ignored for all
but first ZIP archive

1. Another directory traversal vulnerability, differing from that
in WinRAR 7.12, has been fixed.

When extracting a file, previous versions of WinRAR, Windows versions
of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked
into using a path, defined in a specially crafted archive,
instead of user specified path.

Unix versions of RAR, UnRAR, portable UnRAR source code
and UnRAR library, also as RAR for Android, are not affected.

We are thankful to Anton Cherepanov, Peter Kosinar, and Peter Strycek
from ESET for letting us know about this security issue.

2. Bugs fixed:

a) WinRAR 7.12 "Import settings from file" command failed to restore
settings, saved by WinRAR versions preceding 7.12;

b) WinRAR 7.12 set a larger than specified recovery size for compression
profiles, created by WinRAR 5.21 and older.

1. When extracting a file, previous versions of WinRAR, Windows versions
of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked
into using a path, defined in a specially crafted archive,
instead of user specified path.

Unix versions of RAR, UnRAR, portable UnRAR source code
and UnRAR library, also as RAR for Android, are not affected.

We are thankful to whs3-detonator working with Trend Micro Zero Day
Initiative for letting us know about this security issue.

2. Previously "Generate report" command included archived file names
into HTML report as is, allowing to inject potentially unsafe HTML tags
into the report. To prevent such injection the current version replaces
< and > file name characters in HTML report with < and > strings.

We are thankful to Marcin Bobryk (github.com/MarcinB44) for bringing
this security issue to our attention.

3. If "Test archived files" and "recovery volumes" archiving options
are used together, recovery volumes are also tested. Previous versions
completed the test before creating recovery volumes, so they hadn't
been verified.

4. Nanosecond file time precision is preserved for Unix file records
when modifying RAR archive in Windows. Previously it was converted
to Windows 100 nanosecond precision.

1. If "Add to archive..." Explorer context menu command is applied to
multiple archives in the disk root, for example, d:\arc1.rar
and d:\arc2.rar, WinRAR will propose arc1_rar.rar default name
for a new archive. Previous version proposed arc1.rar, updating one
of selected archives instead of creating a new one.

2. Bugs fixed:

a) WinRAR 7.10 failed to update solid archives containing a folder
record placed before a file record. It issued the checksum error
message and aborted processing.

As a result of this fix, this version preserves the original position
of such folders after updating and doesn't move them to the end
of archive as WinRAR 7.10 did;

b) when extracting a file from CAB archive over an existing file,
existing files were overwritten, but not truncated.
So if existing file was larger than extracted, existing file data
had been left at the end of the extracted file;

c) if SFX module from "Advanced SFX options" dialog was stored
in the compression profile, it was applied as is, even if archive
format was changed after selecting the profile. It could result
in SFX module mismatching the archive format;

d) choosing a value in bytes from drop down list associated
with archive dialog "Split to volumes, size" field didn't set
units to bytes automatically;

e) if SFX "TextDone" command was used together with "Silent"
and "TempMode" commands, the completion message was sometimes
displayed behind other opened windows;

f) if symlink pointing at an executable was started from WinRAR shell,
the executable Mark of the Web data was ignored. We are thankful
to Shimamine Taihei of Mitsui Bussan Secure Directions, Inc
for reporting this issue.

1. "Settings/General" dialog page is split to "Settings/Interface"
and "Settings/System" pages. Dialog navigation uses vertical tabs
instead of horizontal.

2. WinRAR sets the dark interface mode if "Color mode" option
in "Settings/Interface" is set to "Dark". This option can enable
dark and light modes unconditionally or use Windows color mode settings.

3. "Large memory pages" option in "Settings/System" dialog and -mlp
command line switch enable using 2 MB memory pages instead of
default 4 KB, when allocating large memory areas in RAR archive
format compression and extraction routines.

It allows to improve archiving and, in some cases, extraction speed.
Typically the performance gain is more significant for bigger
compression dictionaries and slower compression methods.

This feature requires "Lock pages in memory" privilege
and if it is missing, WinRAR proposes to assign it to the current
user account, making it available for other software too.
Windows restart is necessary to activate the newly assigned privilege.

4. "Zone value only" option in "Settings/Security" dialog controls
if archive Mark of the Web propagation includes only the security zone
value or all available fields.

While additional fields, such as a download location or IP address,
might help to identify a file source, they can be a privacy concern
if file is shared with other persons.

5. Switch -om[-|1][=list] controls Mark of the Web propagation
in WinRAR and console RAR command line mode.

6. Windows Vista and 32-bit Windows are not supported anymore.
WinRAR requires Windows 7 x64 or later.

Unlike WinRAR, 32-bit self-extracting modules are still provided
as a part of 64-bit installation package.

7. "Auto", "Always on" and "Disable" choices are now available
for "Delta compression" and "Executable compression" options
in "Advanced compression parameters" dialog.

To improve the compression speed, "Auto" applies these options
depending on the compression method, such as disabling them
for "Fastest" and "Fast" methods. Use "Always on" to enable them
for all methods.

8. Name of environment variable to store the default set of RAR switches
is changed from "RAR" to "RARINISWITCHES". It is rather typical
for batch scripts to use "RAR" environment variable name to store
RAR executable pathname, which led to the name conflict previously.

9. "Completion message title" and "Completion message text" options
on "Text" page of "Advanced SFX options" dialog allow to define
a custom message displayed on the successful completion of SFX archive
extraction.

This message can also be added with "TextDone" script command.

SFX logo and icon options are moved to the new "Logo and icon" page
of "Advanced SFX options" dialog. Dialog navigation uses vertical tabs
instead of horizontal.

10. Windows 11 context menu:

a) compression profiles in the new context menu are placed above
extraction commands, similarly to the legacy context menu;

b) separator lines are inserted between archive open, extraction
and archiving command groups.

11. When extracting a file with NTFS "Compressed" attribute,
this attribute is assigned in the beginning of file extraction.
Typically it reduces the extraction time compared to assigning it
after writing the file data.

12. When adding files to existing RAR archive, folders previously stored
in such archive are moved to a position after newly added files.
So folder timestamps are set after extracting all files and are not
modified when creating files inside of these folders.

13. Temporary file isn't created anymore for "rar ch -tl" command if other
switches or archive parameters do not imply the archive modification.
Modification time of newest archived file is set directly to original
archive file, without copying the archive data. It reduces disk write
and processing time.

14. If archive is truncated at recovery record or quick open information
service blocks, the additional message with truncated block type
is displayed after the stand