CVE-2005-4680

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Sophos Anti-Virus before 4.02, 4.5.x before 4.5.9, 4.6.x before 4.6.9, and 5.x before 5.1.4 allow remote attackers to hide arbitrary files and data via crafted ARJ archives, which are not properly scanned.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.sophos.com/support/knowledgebase/article/3803.htmlVendor Advisory
http://www.vupen.com/english/advisories/2006/0347Permissions Required, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24345Third Party Advisory, VDB Entry
http://www.sophos.com/support/knowledgebase/article/3803.htmlVendor Advisory
http://www.vupen.com/english/advisories/2006/0347Permissions Required, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24345Third Party Advisory, VDB Entry

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-46814.6Buffer overflow in mIRC 5.91, 6.03, 6.12, and 6.16 allows local users to execute arbitrary code via a long string that is entered after reac CVE-2005-46824.3Cross-site scripting (XSS) vulnerability in error.asp in AudienceView allows remote attackers to inject arbitrary web script or HTML via the CVE-2005-46832.1PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other CVE-2005-46846.4Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote a CVE-2005-46856.4Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allow CVE-2005-46865.0PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister_globals function, which allows attack CVE-2005-46875.0PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than CVE-2005-46885.0PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which might allow an attacker to make CVE-2005-46895.0Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sn CVE-2005-46902.1Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types (such a CVE-2005-46912.1imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows loc CVE-2005-46927.5Unspecified vulnerability in mroovca stats (mroovcastats) before 0.4.5b has unknown attack vectors and impact, related to cookies.