CVE-2012-1455

The CVE-2012-1455 entry affects the CAB file parser in NOD32 Antivirus 5795 and Rising Antivirus 22.83.00.03, where a modified vMinor version field in CAB files can bypass malware detection. The vulnerability is tied to the CAB parser implementation in these products and the impact is bypass of d...

CVE-2012-1459

CVE-2012-1459 affects multiple antivirus products including ClamAV. The issue is a vulnerability in the TAR file parser where a TAR archive entry length field could correspond to the entire entry plus part of the header of the next entry, allowing remote attackers to bypass malware detection. The...

CVE-2012-1458

The CVE-2012-1458 issue affects the CHM file parser in ClamAV (v0.96.4) and Sophos Anti-Virus (v4.61.0), allowing remote bypass of malware detection via a crafted reset interval in the CHM file’s LZXC header. Publicly linked advisories and OpenVAS/Nessus entries confirm this as a vulnerability ti...

CVE-2012-1439

The CVE affects the ELF file parsers in eSafe 7.0.17.0, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7. The root cause is a flaw in the ELF parser’s handling of a modified padding field, which enables remote attackers to bypass malware detection. Impact i...

CVE-2012-1463

The CVE-2012-1463 entry describes a vulnerability in the ELF file parsers used by multiple antivirus products (e.g., AhnLab V3 Internet Security, Bitdefender, Quick Heal, Command Antivirus, Comodo, eSafe, F-Prot, F-Secure, McAfee, Norman, nProtect, Panda). The issue is a flaw in the ELF parser re...

CVE-2012-1444

The CVE-2012-1444 entry concerns the ELF file parser logic in eSafe 7.0.17.0, Prevx 3.0, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 where a modified ELF abiversion field allows remote attackers to bypass malware detection. The available documents indicate affected products and the...

CVE-2012-1456

The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal aka Cat QuickHeal 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus...

CVE-2012-1430

The CVE-2012-1430 entry concerns multiple antivirus products (Bitdefender 7.2, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Secure 9.0.16160.0, McAfee Scan Engine 5.400.0.1158, McAfee Gateway 2010.1C, nProtect 2011-01-17.01, Sophos 4.61.0, Rising 22.83.00.03) whose ELF file parser can be bypassed by ...

CVE-2012-1435

The CVE-2012-1435 entry describes a vulnerability in the Microsoft EXE file parser used by several antivirus products (AhnLab V3 Internet Security, Emsisoft Anti-Malware, eSafe, Ikarus, Panda Antivirus). The vulnerability allows remote attackers to bypass malware detection when processing an EXE ...

CVE-2012-1433

Technical details about CVE-2012-1433 are not publicly disclosed in the provided documents beyond the description of a file parser bypass. Monitor for updates; no confirmed affected products, vulnerable components, impact, or fixes are specified in the supplied data.

CVE-2012-1421

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MSCF character sequence. NOTE:...

CVE-2012-1426

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, K7 AntiVirus 9.77.3565, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \42\5A\68...

CVE-2012-1423

The TAR file parser in Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, K7 AntiVirus 9.77.3565, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5,...

CVE-2012-1449

The CAB file parser in NOD32 Antivirus 5795 and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a CAB file with a modified vMajor field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred...

CVE-2012-1450

The CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Sophos Anti-Virus 4.61.0, and Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0 allows remote attackers to bypass malware detection via a CAB file with a modified reserved3 field. NOTE: this may later be SPLIT into multiple CVEs if...

CVE-2012-1460

The Gzip file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal aka Cat QuickHeal 11.00, Command Antivirus 5.2.11.5, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, and VBA32 3.12.14.2 allows remote attackers to bypass malware detection via a .tar.g...

CVE-2012-1452

The CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Quick Heal aka Cat QuickHeal 11.00 allows remote attackers to bypass malware detection via a CAB file with a modified reserved1 field. NOTE: this may later be SPLIT into multiple CVE...

CVE-2012-1447

The ELF file parser in Fortinet Antivirus 4.2.254.0, eSafe 7.0.17.0, Dr.Web 5.0.2.03300, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified eversion field. NOTE: this may later be SPLIT into multiple CVEs if additional information is...

CVE-2012-1448

The CAB file parser in Quick Heal aka Cat QuickHeal 11.00, Trend Micro AntiVirus 9.120.0.1004, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Trend Micro HouseCall 9.120.0.1004, and Emsisoft Anti-Malware 5.1.0.1 allows remote attackers to bypass malware detection via a CAB file with a...

CVE-2012-1433

The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \4a\46\49\46...