9.3

CVE-2007-6060

AhnLab Antivirus 3 Internet Security 2008 Platinum appends data to a filename string at a location indicated by the "Filename length" field in a ZIP header, which allows remote attackers to cause a denial of service (machine crash) and possibly execute arbitrary code via a ZIP file in which this field's value is larger than the actual number of bytes in the filename.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ahnlab ≫ V3 Internet Security Version2008 Editionplatinum
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.7% 0.92
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://global.ahnlab.com/global/notice_view.ESD?fmethod=view&press_seq=803&printNum=2
http://osvdb.org/42352
http://secunia.com/advisories/27757
http://securityreason.com/securityalert/3382
http://secway.org/advisory/AD20071116.txt
http://www.securityfocus.com/archive/1/483799/100/0/threaded
http://www.securityfocus.com/bid/26473
http://www.securitytracker.com/id?1018977
http://www.vupen.com/english/advisories/2007/3983
https://exchange.xforce.ibmcloud.com/vulnerabilities/38514