CVE-2007-3771: Symantec Client Security

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the Internet E-mail Auto-Protect feature in Symantec AntiVirus Corporate Edition before 10.1, and Client Security before 3.1, allows local users to cause a denial of service (service crash) via a long (1) To, (2) From, or (3) Subject header in an outbound SMTP e-mail message. NOTE: the original vendor advisory referenced CVE-2006-3456, but this was an error.

Affected products

• Symantec Client Security: version 2.0 only; version 3.0 only; version 3.0.1.1000 only; version 3.0.1.1007 only; version 3.0.1.1009 only; version 3.0.2 only; …
• Symantec Norton Antivirus: version 9.0 only; version 9.0.0.338 only; version 9.0.1 only; version 9.0.1.1.1000 only; version 9.0.1.1000 only; version 9.0.2 only; …

Published 2007-07-15. Last modified 2026-06-16.