Sophos Scanning Engine vulnerabilities

4 CVEs affecting Sophos Scanning Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-1213, published 2014-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-4578, published 2007-08-28. Medium severity, CVSS 6.8. EPSS: 7.3% chance of exploitation in the next 30 days. Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UPX packed file,…
CVE-2007-4787, published 2007-09-10. Medium severity, CVSS 5.0. EPSS: 5.7% chance of exploitation in the next 30 days. The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2) LZH, and (3) RAR files with modified headers, which might allow remote attackers to…
CVE-2007-4577, published 2007-08-28. High severity, CVSS 7.8. EPSS: 5.5% chance of exploitation in the next 30 days. Sophos Anti-Virus for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed BZip file that results in the creation of multiple Engine temporary…
CVE-2014-1213, published 2014-02-10. Medium severity, CVSS 5.6. EPSS: 1% chance of exploitation in the next 30 days. Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects,…