Unscored severity · published Oct 5, 2007
CVE-2007-0447
Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives
–
CVSS
6%
EPSS
No
On KEV
Description
Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Antivirus Scan Engine · Symantec
4.0; 4.0; 4.1; 4.1.8; 4.3; 4.3; +14 more · source: NVD
BA
Brightmail Antispam · Symantec
4.0; 5.5; 6.0; 6.0.1; 6.0.2; 6.0.3; +1 more · source: NVD
CS
Client Security · Symantec
2.0; 2.0; 2.0; 2.0.1_build_9.0.1.1000; 2.0.2_build_9.0.2.1000; 2.0.3_build_9.0.3.1000; +22 more · source: NVD
GS
Gateway Security 5000 Series · Symantec
3.0.1 · source: NVD
GS
Gateway Security 5400 · Symantec
2.0.1 · source: NVD
MS
Mail Security · Symantec
4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +20 more · source: NVD
MS
Mail Security 8820 Appliance · Symantec
All versions, or not specified · source: NVD
NA
Norton Antivirus · Symantec
9.0; 9.0; 9.0.0; 9.0.0.338; 9.0.1; 9.0.1.1.1000; +34 more · source: NVD
NI
Norton Internet Security · Symantec
3.0; 2004; 2004; 2005; 2005; 2005; +4 more · source: NVD
NP
Norton Personal Firewall · Symantec
2006; 2006_9.1.0.33; 2006_9.1.1.7 · source: NVD
NS
Norton System Works · Symantec
3.0; 2004; 2005; 2005; 2005; 2005; +1 more · source: NVD
SA
Symantec Antivirus Filtering +for Domino · Symantec
3.0.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0447
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0447
osvdb.org
http://osvdb.org/36118
Vendor Advisory
http://secunia.com/advisories/26053
Patch
http://securityresponse.symantec.com/avcenter/security/Content/2007.07.11f.html
www.securityfocus.com
http://www.securityfocus.com/bid/24282
www.vupen.com
http://www.vupen.com/english/advisories/2007/2508
www.zerodayinitiative.com
http://www.zerodayinitiative.com/advisories/ZDI-07-040.html
More from Antivirus Scan Engine
7.0
CVE-2004-0217
The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary files via a symlink…
–
CVE-2007-3699
The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR…
–
CVE-2006-0231
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct…
–
CVE-2006-0230
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator…
–
CVE-2006-0232
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control,…