9
CVE-2016-2209
- EPSS 29.05%
- Published 30.06.2016 23:59:02
- Last modified 12.04.2025 10:46:40
- Source secure@symantec.com
- Teams watchlist Login
- Open Login
Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code via a crafted file.
Data is provided by the National Vulnerability Database (NVD)
Symantec ≫ Mail Security For Microsoft Exchange Version >= 7.0 <= 7.0.4
Symantec ≫ Mail Security For Microsoft Exchange Version >= 7.5 <= 7.5.4
Symantec ≫ Mail Security For Microsoft Exchange Version6.5.8
Symantec ≫ Norton Power Eraser Version <= 5.0
Symantec ≫ Protection Engine Version >= 7.0.0 <= 7.0.5
Symantec ≫ Protection Engine Version >= 7.5.0 <= 7.5.4
Symantec ≫ Protection Engine Version7.8.0
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp1
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp1a
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp2
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp3
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp4
Symantec ≫ Message Gateway Version <= 10.6.1-3
Symantec ≫ Message Gateway For Service Providers Version10.5
Symantec ≫ Message Gateway For Service Providers Version10.6
Symantec ≫ Norton Bootable Removal Tool Version <= 2016.0
Symantec ≫ Mail Security For Domino Version >= 8.0 <= 8.0.9
Symantec ≫ Mail Security For Domino Version >= 8.1 <= 8.1.3
Symantec ≫ Data Center Security Server Version6.0
Symantec ≫ Data Center Security Server Version6.0 Updatemp1
Symantec ≫ Data Center Security Server Version6.5
Symantec ≫ Data Center Security Server Version6.5 Updatemp1
Symantec ≫ Data Center Security Server Version6.6
Symantec ≫ Data Center Security Server Version6.6 Updatemp1
Symantec ≫ Norton Security SwPlatformmacos Version <= 13.0.1
Symantec ≫ Advanced Threat Protection Version <= 2.0.3
Symantec ≫ Protection For Sharepoint Servers Version6.03
Symantec ≫ Protection For Sharepoint Servers Version6.04
Symantec ≫ Protection For Sharepoint Servers Version6.05
Symantec ≫ Protection For Sharepoint Servers Version6.06
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp1
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp1a
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp2
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp3
Symantec ≫ Endpoint Protection Version12.1.6 Updatemp4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 29.05% | 0.964 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.3 | 2.5 | 4.7 |
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
|
| nvd@nist.gov | 9 | 10 | 8.5 |
AV:N/AC:L/Au:N/C:P/I:P/A:C
|
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.