Login Request a demo
Unscored severity · published Feb 8, 2005
CVE-2005-0249
Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative…
–
CVSS
18.8%
EPSS
No
On KEV
Description
Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.
Exploitation
Is it being used?
Exploit prediction (EPSS)18.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Antivirus Scan Engine · Symantec
before 4.3.3 · source: NVD
BA
Brightmail Antispam · Symantec
4.0; 5.5 · source: NVD
CS
Client Security · Symantec
1.0.1_build_8.01.434; 1.0.1_build_8.01.437; 1.0.1_build_8.01.446; 1.0.1_build_8.01.457; 1.0.1_build_8.01.460; 1.0.1_build_8.01.464; +6 more · source: NVD
GS
Gateway Security · Symantec
1.0; 2.0; 2.0.1 · source: NVD
MS
Mail Security · Symantec
4.0; 4.1; 4.1; 4.1; 4.5_build_719 · source: NVD
NA
Norton Antivirus · Symantec
2.18_build_83; 8.1.1.319; 8.1.1.323; 8.1.1.329; 8.1.1_build8.1.1.314a; 8.01.434; +8 more · source: NVD
NI
Norton Internet Security · Symantec
2004 · source: NVD
NS
Norton System Works · Symantec
2004 · source: NVD
SF
Sav Filter Domino NT Ports · Symantec
build3.0.5; build3.0.5 · source: NVD
SF
Sav Filter For Domino NT · Symantec
3.1.1 · source: NVD
WS
Web Security · Symantec
3.01.59; 3.01.60; 3.01.61; 3.01.62; 3.01.63; 3.01.67; +1 more · source: NVD
Affected product
AS
Antivirus Scan Engine
Symantec
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0249
Third Party Advisory
http://securitytracker.com/id?1013133
Patch
http://www.kb.cert.org/vuls/id/107822
Patch
http://www.symantec.com/avcenter/security/Content/2005.02.08.html
Patch
http://xforce.iss.net/xforce/alerts/id/187
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/18869
More from Antivirus Scan Engine
7.0
CVE-2004-0217
The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary files via a symlink…
–
CVE-2007-3699
The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR…
–
CVE-2007-0447
Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives
–
CVE-2006-0231
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct…
–
CVE-2006-0230
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator…