Vulnerability Details : CVE-2007-6595
ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.
Products affected by CVE-2007-6595
- cpe:2.3:a:clam_anti-virus:clamav:0.92:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2007-6595
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 14 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-6595
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:P/A:N |
3.9
|
2.9
|
NIST |
CWE ids for CVE-2007-6595
-
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-6595
-
http://security.gentoo.org/glsa/glsa-200808-07.xml
ClamAV: Multiple Denials of Service (GLSA 200808-07) — Gentoo security
-
http://kolab.org/security/kolab-vendor-notice-19.txt
Page not found
-
http://secunia.com/advisories/29891
About Secunia Research | Flexera
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/39339
ClamAV Sigtool file overwrite undefined Vulnerability Report
-
http://www.securityfocus.com/bid/27064
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:088
Mandriva
-
http://www.debian.org/security/2008/dsa-1497
[SECURITY] [DSA 1497-1] New clamav packages fix several vulnerabilities
-
http://www.vupen.com/english/advisories/2008/0606
Site en construction
-
http://www.securityfocus.com/archive/1/485631/100/0/threaded
-
http://secunia.com/advisories/28949
About Secunia Research | FlexeraVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/39335
ClamAV cli_gentempfd() symlink CVE-2007-6595 Vulnerability Report
-
http://securitytracker.com/id?1019148
Access Denied
-
http://secunia.com/advisories/31437
About Secunia Research | Flexera
-
http://securityreason.com/securityalert/3501
Multiple vulnerabilities in ClamAV - CXSecurity.com
-
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html
[security-announce] SUSE Security Announcement: clamav (SUSE-SA:2008:024) - openSUSE Security Announce - openSUSE Mailing Lists
Jump to