CVE-2007-4787

CWE-20 — Improper Input Validation3 documents3 sources
Severity
5.0MEDIUM
EPSS
1.9%
top 16.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sophos Scanning EngineSophos Sophos Anti-virus
Timeline
PublishedSep 10
Latest updateMay 1

Description

The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2) LZH, and (3) RAR files with modified headers, which might allow remote attackers to bypass malware detection.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDsophos/sophos_anti-virus34 versions+33

Patches

Patch: www.sophos.com ↗Patch: www.sophos.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-2263-gvv9-23vp: The virus detection engine in Sophos Anti-Virus before 2↗2022-05-01
▶
CVEList
CVE-2007-4787: The virus detection engine in Sophos Anti-Virus before 2↗2007-09-10
▶
CVE-2007-4787 (MEDIUM CVSS 5) | The virus detection engine in Sopho | cvebase.io