CVE-2006-3890

2006-11-2122:07:00

[email protected]

web.nvd.nist.gov

cve-2006-3890

buffer overflow

sky software

fileview

activex

winzip

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

Low

0.963 High

EPSS

Percentile

99.5%

JSON

Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other applications, allows remote attackers to execute arbitrary code via a long FilePattern attribute in a WZFILEVIEW object, a different vulnerability than CVE-2006-5198.

Affected configurations

NVD

Node

sky_softwarefileview_activex_control

winzipwinzipRange≤10.0

winzipwinzipMatch7.0

winzipwinzipMatch8.0

winzipwinzipMatch8.1

winzipwinzipMatch8.1sr1

winzipwinzipMatch9.0

CPENameOperatorVersion
sky_software:fileview_activex_controlsky software fileview activex controleq*
winzip:winzipwinziple10.0
winzip:winzipwinzipeq7.0
winzip:winzipwinzipeq8.0
winzip:winzipwinzipeq8.1
winzip:winzipwinzipeq9.0

CPE	Name	Operator	Version
sky_software:fileview_activex_control	sky software fileview activex control	eq	*
winzip:winzip	winzip	le	10.0
winzip:winzip	winzip	eq	7.0
winzip:winzip	winzip	eq	8.0
winzip:winzip	winzip	eq	8.1
winzip:winzip	winzip	eq	9.0