Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-0538

Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file).

Published

2009-03-18T15:30:00.453

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.6 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

3.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-134
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application symantec pcanywhere ≤ 12.5 Yes
Application symantec pcanywhere 10.0 Yes
Application symantec pcanywhere 10.5 Yes
Application symantec pcanywhere 11.0 Yes
Application symantec pcanywhere 11.0.1 Yes
Application symantec pcanywhere 11.5 Yes
Application symantec pcanywhere 11.5.1 Yes
Application symantec pcanywhere 12.0 Yes
Application symantec pcanywhere 12.1 Yes
References