Vulnerabilities > Sophos > Anti Virus
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-07-22 | CVE-2014-2385 | Cross-Site Scripting vulnerability in Sophos Anti-Virus 9.5.1 Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter to exclusion/configure or (4) text:EmailServer or (5) newListList:Email parameter to notification/configure. | 4.3 |
| 2010-06-16 | CVE-2010-2308 | Local Security vulnerability in Anti-Virus Small Business Edition Unspecified vulnerability in the filter driver (savonaccessfilter.sys) in Sophos Anti-Virus before 7.6.20 allows local users to gain privileges via crafted arguments to the NtQueryAttributesFile function. | 7.2 |
| 2009-08-06 | CVE-2008-6904 | File Processing Remote Denial Of Service vulnerability in Sophos Anti-Virus and Anti-Virus7.6.3 Multiple unspecified vulnerabilities in Sophos SAVScan 4.33.0 for Linux, and possibly other products and versions, allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via crafted files that have been packed with (1) armadillo, (2) asprotect, or (3) asprotectSKE. | 10.0 |
| 2009-08-06 | CVE-2008-6903 | Resource Management Errors vulnerability in Sophos Anti-Virus and Anti-Virus7.6.3 Sophos Anti-Virus for Windows before 7.6.3, Anti-Virus for Windows NT/9x before 4.7.18, Anti-Virus for OS X before 4.9.18, Anti-Virus for Linux before 6.4.5, Anti-Virus for UNIX before 7.0.5, Anti-Virus for Unix and Netware before 4.37.0, Sophos EM Library, and Sophos small business solutions, when CAB archive scanning is enabled, allows remote attackers to cause a denial of service (segmentation fault) via a "fuzzed" CAB archive file, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats. | 4.3 |
| 2008-12-12 | CVE-2008-5541 | Improper Input Validation vulnerability in Sophos Anti-Virus 4.33.0 Sophos Anti-Virus 4.33.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit. | 9.3 |
| 2008-04-30 | CVE-2008-1737 | Improper Input Validation vulnerability in Sophos Anti-Virus 7.0.5 Sophos Anti-Virus 7.0.5, and other 7.x versions, when Runtime Behavioural Analysis is enabled, allows local users to cause a denial of service (reboot with the product disabled) and possibly gain privileges via a zero value in a certain length field in the ObjectAttributes argument to the NtCreateKey hooked System Service Descriptor Table (SSDT) function. | 6.9 |
| 2007-09-10 | CVE-2007-4512 | Cross-Site Scripting vulnerability in Sophos Anti-Virus Cross-site scripting (XSS) vulnerability in Sophos Anti-Virus for Windows 6.x before 6.5.8 and 7.x before 7.0.1 allows remote attackers to inject arbitrary web script or HTML via an archive with a file that matches a virus signature and has a crafted filename that is not properly handled by the print function in SavMain.exe. | 4.3 |
| 2007-08-28 | CVE-2007-4578 | Numeric Errors vulnerability in Sophos Anti-Virus, Scanning Engine and Small Business Suite Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UPX packed file, resulting from an "integer cast around". | 6.8 |
| 2007-08-28 | CVE-2007-4577 | Resource Management Errors vulnerability in Sophos Anti-Virus, Scanning Engine and Small Business Suite Sophos Anti-Virus for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed BZip file that results in the creation of multiple Engine temporary files (aka a "BZip bomb"). | 7.8 |
| 2006-11-01 | CVE-2006-5647 | Buffer Errors vulnerability in Sophos Anti-Virus and Endpoint Security Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a malformed CHM file with a large name length in the CHM chunk header, aka "CHM name length memory consumption vulnerability." | 6.4 |