CVE Vulnerability

CVE-2007-3675

Multiple format string vulnerabilities in the kavwebscan.CKAVWebScan ActiveX control (kavwebscan.dll) in Kaspersky Online Scanner before 5.0.98 allow remote attackers to execute arbitrary code via format string specifiers in "various string formatting functions," which trigger heap-based buffer overflows.

9.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=606
http://www.kaspersky.com/news?id=207575572 Patch
http://www.securityfocus.com/bid/26004 Patch
http://securitytracker.com/id?1018800 Patch
http://secunia.com/advisories/27187 Patch Vendor Advisory
http://www.vupen.com/english/advisories/2007/3455
https://exchange.xforce.ibmcloud.com/vulnerabilities/37057
Configurations

Configuration 1

cpe:2.3:a:kaspersky_lab:online_scanner:*:*:*:*:*:*:*:*
Information

Published : 2007-10-12 08:17

Updated : 2017-07-29 01:32

NVD link : CVE-2007-3675

Mitre link : CVE-2007-3675

Products Affected
No products.
CWE
CWE-134

Use of Externally-Controlled Format String