CVE-2007-6335
HighSummary
Przepełnienie całkowite w libclamav w ClamAV przed wersją 0.92 umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez spreparowany plik MEW spakowany w formacie PE, co prowadzi do przepełnienia bufora na stercie.
Risk Assessment
Atakujący mogą wykorzystać tę podatność do zdalnego uruchomienia kodu, co może prowadzić do kompromitacji systemu i utraty danych.
Recommendation
Zaleca się aktualizację ClamAV do najnowszej wersji, aby usunąć tę podatność oraz monitorowanie systemów pod kątem nieautoryzowanych działań.
Related vulnerabilities
- CVE-2026-87827Critical
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker can execute arbitrary system commands, potentially leading to complete compromise. Exploited by Mirai_ptea and Mirai_aurora botnets for malware propagation and DDoS.
- CVE-2026-85978Critical
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy allows authentication bypass and access to an endpoint that executes attacker-supplied script code without sandboxing, leading to arbitrary code execution.
- CVE-2026-79696Critical
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
- CVE-2026-16272Critical
Use of less trusted source vulnerability in PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects versions from v9.0.0 before v9.0.3.
- CVE-2026-21102Critical
Use-after-free vulnerability in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-87654Critical
Buffer overflow in ANGLE in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-87650Critical
Out-of-bounds read in WebGL in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-87646Critical
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
Original NVD description (English source)
Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow.