CVE-2007-1673: Amavis

High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days.

unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

Affected products

• Amavis Amavis: up to and including 2.4.1
• Avast Avast Antivirus: up to and including 4.7.980; version 4.6.394 only; version 4.7.652 only; version 4.7.700 only
• Avast Avast Antivirus Home: version 4.0 only; version 4.6 only; version 4.6.652 only; version 4.6.655 only; version 4.6.665 only; version 4.6.691 only; …
• Avast Avast Antivirus Professional: version 4.0 only; version 4.6 only; version 4.6.603 only; version 4.6.652 only; version 4.6.665 only; version 4.6.691 only; …
• Avira Antivir: any version; version 6.35.00.00 only; version 7.04.00.23 only
• Avira Antivir Personal: any version; up to and including 7.3.0.5; version 7 only
• Barracuda Networks Barracuda Spam Firewall: any version; version model_100 only; version model_200 only; version model_300 only; version model_400 only; version model_500 only; …
• Panda Panda Antivirus: version 2007 only
• Panda Panda Antivirus And Firewall: version 2007 only
• Picozip Picozip: any version
• Rahul Dhesi Zoo: up to and including 2.10
• Unzoo Unzoo: version 4.4 only
• Winace Winace: any version

Published 2007-05-09. Last modified 2026-06-16.