CVSS: 6.8EPSS: 8%CPEs: 37EXPL: 0CVE-2007-4578
https://notcve.org/view.php?id=CVE-2007-4578
Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UPX packed file, resulting from an "integer cast around". NOTE: as of 20070828, the vendor says this is a DoS and the researcher says this allows code execution, but the researcher is reliable. Sophos Anti-Virus para Windows y para Unix/Linux anterior a 2.48.0 permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código de su elección mediante un archivo empaquetado con UPX manipulado, resultado de una "conversión de vuelta de entero" (integer cast around). NOTA: a fecha de 28/08/2007, el fabricante dice que esto es una denegación de servicio y el investigador dice que permite ejecución de código, pero el investigador es fiable. • http://secunia.com/advisories/26580 http://securityreason.com/securityalert/3072 http://securitytracker.com/id?1018608 http://www.nruns.com/security_advisory_sophos_upx_infinite_loop_dos.php http://www.securityfocus.com/archive/1/477720/100/0/threaded http://www.securityfocus.com/archive/1/477864/100/0/threaded http://www.securityfocus.com/archive/1/477882/100/0/threaded http://www.securityfocus.com/bid/25428 http://www.sophos.com/support/knowledgebase/article/28407.html http:/& • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 72%CPEs: 16EXPL: 1CVE-2006-5646 – Sophos AntiVirus - '.CHM' File Heap Overflow (PoC)
https://notcve.org/view.php?id=CVE-2006-5646
Heap-based buffer overflow in Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11, when archive scanning is enabled, allows remote attackers to trigger a denial of service (memory corruption) via a CHM file with an LZX decompression header that specifies a Window_size of 0. Desbordamiento de búfer basado en montón en Sophos Anti-Virus y Endpoint Security versiones anteriores a 6.0.5, Anti-Virus para Linux anteriores a 5.0.10, y otras plataformas anteriores a 4.11, cuando el escaneo de archivos está habilitado, permite a atacantes remotos disparar una denegación de servicio (corrupción de memoria) a través de un archivo CHM con una cabecera de descompresión LZX que especifica un tamaño de ventana 0. • https://www.exploit-db.com/exploits/2910 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=452 http://secunia.com/advisories/22591 http://securitytracker.com/id?1017132 http://www.securityfocus.com/bid/20816 http://www.sophos.com/support/knowledgebase/article/7609.html http://www.vupen.com/english/advisories/2006/4239 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.4EPSS: 13%CPEs: 16EXPL: 1CVE-2006-5647 – Sophos AntiVirus - '.CHM' Chunk Name Length Memory Corruption (PoC)
https://notcve.org/view.php?id=CVE-2006-5647
Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a malformed CHM file with a large name length in the CHM chunk header, aka "CHM name length memory consumption vulnerability." Sophos Anti-Virus y Endpoint Security versiones anteriores a 6.0.5, Anti-Virus para Linux anteriores a 5.0.10, y otras plataformas anteriores a 4.11 permite a atacantes remotos provocar una denegación de servicio (corrupción o agotamiento de memoria) y posiblemente ejecutar código de su elección mediante un fichero CHM mal formado con manipulaciones concretas del segmento de cabecera CHM, también conocido como "vulnerabilidad de agotamiento de memoria en longitud de nombre CHM". • https://www.exploit-db.com/exploits/2911 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=451 http://secunia.com/advisories/22591 http://securitytracker.com/id?1017132 http://www.securityfocus.com/bid/20816 http://www.sophos.com/support/knowledgebase/article/7609.html http://www.vupen.com/english/advisories/2006/4239 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 18%CPEs: 16EXPL: 1CVE-2006-5645 – Sophos / Trend Micro AntiVirus - '.RAR' File Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2006-5645
Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11, when "Enabled scanning of archives" is set, allows remote attackers to cause a denial of service (infinite loop) via a malformed RAR archive with an Archive Header section with the head_size and pack_size fields set to zero. Sophos Anti-Virus y Endpoint Security anteriores a 6.0.5, Anti-virus para Linux 5.0.10, y otras plataformas en versiones anteriores a la 4.11, permite a atacantes remotos causar denegación de servicio (bucle infinito) mediante un fichero RAR mal formado con una sección de Cabecera de Archivo con los campos head_size y pack_size puestos a cero. • https://www.exploit-db.com/exploits/2912 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=439 http://secunia.com/advisories/22591 http://securitytracker.com/id?1017132 http://www.securityfocus.com/archive/1/474683/100/0/threaded http://www.securityfocus.com/bid/20816 http://www.securitytracker.com/id?1018450 http://www.sophos.com/support/knowledgebase/article/7609.html http://www.vupen.com/english/advisories/2006/4239 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2005-4680
https://notcve.org/view.php?id=CVE-2005-4680
Sophos Anti-Virus before 4.02, 4.5.x before 4.5.9, 4.6.x before 4.6.9, and 5.x before 5.1.4 allow remote attackers to hide arbitrary files and data via crafted ARJ archives, which are not properly scanned. • http://www.sophos.com/support/knowledgebase/article/3803.html http://www.vupen.com/english/advisories/2006/0347 https://exchange.xforce.ibmcloud.com/vulnerabilities/24345 •