CVE-2007-0603 PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote au...
HighCVSS 7.1
EPSS 5.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pgp corporate desktop | = 9.5 | No fix listed |
References
- 20070125 Medium Risk Vulnerability in PGP Desktop mailing-list
- 32969 vdb-entry
- 32970 vdb-entry
- 23938 third-party-advisory vendor-advisory
- 2203 third-party-advisory
- 1017563 vdb-entry
- VU#102465 third-party-advisory us-government-resource
- www.ngssoftware.com vendor-advisory
- 20070125 Medium Risk Vulnerability in PGP Desktop mailing-list
- 22247 vdb-entry
- ADV-2007-0356 vdb-entry