Search for vulnerabilities
Vulnerability details: VCID-eyx9-9q83-aaaj
Vulnerability ID VCID-eyx9-9q83-aaaj
Aliases CVE-2007-1997
Summary Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.09324 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.10821 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.15597 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.15597 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.15597 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.15597 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
epss 0.20259 https://api.first.org/data/v1/epss?cve=CVE-2007-1997
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2007-1997
Reference id Reference type URL
http://docs.info.apple.com/article.html?artnum=307562
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=513
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
https://api.first.org/data/v1/epss?cve=CVE-2007-1997
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1997
http://secunia.com/advisories/24891
http://secunia.com/advisories/24920
http://secunia.com/advisories/24946
http://secunia.com/advisories/24996
http://secunia.com/advisories/25022
http://secunia.com/advisories/25028
http://secunia.com/advisories/25189
http://secunia.com/advisories/29420
http://security.gentoo.org/glsa/glsa-200704-21.xml
https://exchange.xforce.ibmcloud.com/vulnerabilities/33637
http://sourceforge.net/project/shownotes.php?release_id=500765
http://support.novell.com/techcenter/psdb/50a5cb718f20761dd7e0b6b4e0935c52.html
http://www.debian.org/security/2007/dsa-1281
http://www.mandriva.com/security/advisories?name=MDKSA-2007:098
http://www.novell.com/linux/security/advisories/2007_26_clamav.html
http://www.securityfocus.com/bid/23473
http://www.securitytracker.com/id?1017921
http://www.trustix.org/errata/2007/0013/
http://www.vupen.com/english/advisories/2007/1378
http://www.vupen.com/english/advisories/2008/0924/references
cpe:2.3:a:clam_anti-virus:clamav:0.90:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clam_anti-virus:clamav:0.90:*:*:*:*:*:*:*
cpe:2.3:a:clam_anti-virus:clamav:0.90.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clam_anti-virus:clamav:0.90.1:*:*:*:*:*:*:*
cpe:2.3:a:clam_anti-virus:clamav:0.90.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clam_anti-virus:clamav:0.90.2:*:*:*:*:*:*:*
cpe:2.3:a:clam_anti-virus:clamav:0.90_rc1.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clam_anti-virus:clamav:0.90_rc1.1:*:*:*:*:*:*:*
cpe:2.3:a:clam_anti-virus:clamav:0.90_rc2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clam_anti-virus:clamav:0.90_rc2:*:*:*:*:*:*:*
cpe:2.3:a:clam_anti-virus:clamav:0.90_rc3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clam_anti-virus:clamav:0.90_rc3:*:*:*:*:*:*:*
CVE-2007-1997 https://nvd.nist.gov/vuln/detail/CVE-2007-1997
GLSA-200704-21 https://security.gentoo.org/glsa/200704-21
No exploits are available.
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2007-1997
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.87805
EPSS Score 0.09324
Published At March 29, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.