CVE-2014-1213

CWE-2643 documents3 sources
Severity
5.6MEDIUM
EPSS
0.1%
top 75.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sophos Scanning EngineSophos Sophos Anti-virus
Timeline
PublishedFeb 10
Latest updateMay 14

Description

Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSA…

CVSS vector

AV:L/AC:L/C:N/I:P/A:CExploitability: 3.9 | Impact: 7.8

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-r9jr-628j-pc37: Sophos Anti-Virus engine (SAVi) before 3↗2022-05-14
▶
CVEList
CVE-2014-1213: Sophos Anti-Virus engine (SAVi) before 3↗2014-02-10
▶
CVE-2014-1213 (MEDIUM CVSS 5.6) | Sophos Anti-Virus engine (SAVi) bef | cvebase.io