Symantec Norton Personal Firewall vulnerabilities

18 CVEs affecting Symantec Norton Personal Firewall, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-3699, published 2007-10-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-1689, published 2007-05-16. High severity, CVSS 10.0. EPSS: 65% chance of exploitation in the next 30 days. Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows remote attackers to execute arbitrary code via long arguments…
CVE-2004-0444, published 2004-07-07. High severity, CVSS 10.0. EPSS: 12.8% chance of exploitation in the next 30 days. Multiple vulnerabilities in SYMDNS.SYS for Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 through 2004, Norton AntiSpam 2004, Client Firewall 5.01…
CVE-2004-0445, published 2004-07-07. Low severity, CVSS 2.6. EPSS: 11% chance of exploitation in the next 30 days. The SYMDNS.SYS driver in Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 through 2004, Norton AntiSpam 2004, Client Firewall 5.01 and 5.1.1, and…
CVE-2004-0375, published 2004-08-18. Medium severity, CVSS 5.0. EPSS: 8.8% chance of exploitation in the next 30 days. SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 and 1.1 allow remote attackers to cause…
CVE-2007-0447, published 2007-10-05. High severity, CVSS 9.3. EPSS: 6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives.
CVE-2007-3699, published 2007-10-05. High severity, CVSS 9.3. EPSS: 3.9% chance of exploitation in the next 30 days. The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR archive file header.
CVE-2002-0663, published 2002-07-26. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Buffer overflow in HTTP Proxy for Symantec Norton Personal Internet Firewall 3.0.4.91 and Norton Internet Security 2001 allows remote attackers to cause a denial of service and possibly execute…
CVE-2002-2336, published 2002-12-31. Medium severity, CVSS 4.3. EPSS: 2.5% chance of exploitation in the next 30 days. Norton Personal Firewall 2002 4.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVE-2007-1793, published 2007-04-02. Medium severity, CVSS 4.9. EPSS: 1.7% chance of exploitation in the next 30 days. SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause…
CVE-2002-1778, published 2002-12-31. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. Symantec Norton Personal Firewall 2002 allows remote attackers to bypass the portscan protection by using a (1) SYN/FIN, (2) SYN/FIN/URG, (3) SYN/FIN/PUSH, or (4) SYN/FIN/URG/PUSH scan.

Latest

CVE-2007-3673, published 2007-07-15. Medium severity, CVSS 6.9. EPSS: 1.1% chance of exploitation in the next 30 days. Symantec symtdi.sys before 7.0.0, as distributed in Symantec AntiVirus Corporate Edition 9 through 10.1 and Client Security 2.0 through 3.1, Norton AntiSpam 2005, and Norton AntiVirus, Internet…
CVE-2007-1495, published 2007-03-16. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service (system crash)…
CVE-2007-1476, published 2007-03-16. Low severity, CVSS 1.9. EPSS: 0.9% chance of exploitation in the next 30 days. The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other…
CVE-2006-4855, published 2006-09-19. Medium severity, CVSS 4.9. EPSS: 1.3% chance of exploitation in the next 30 days. The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.0.33, and other versions of Norton Personal Firewall, Internet Security, AntiVirus, SystemWorks, Symantec Client Security SCS…
CVE-2006-4266, published 2006-08-21. Low severity, CVSS 3.6. EPSS: 0.4% chance of exploitation in the next 30 days. Symantec Norton Personal Firewall 2006 9.1.0.33, and possibly earlier, does not properly protect Norton registry keys, which allows local users to provide Trojan horse libraries to Norton by using…
CVE-2006-3725, published 2006-07-21. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Norton Personal Firewall 2006 9.1.0.33 allows local users to cause a denial of service (crash) via certain RegSaveKey, RegRestoreKey and RegDeleteKey operations on the (1)…