CVE-2019-14270

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container feature, are vulnerable to Sandbox Escape.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gaissecurity.com/yazi/discovery-of-sandbox-escape-on-comodo-container-antivirus-amp-firewallExploit, Third Party Advisory
https://gaissecurity.com/yazi/discovery-of-sandbox-escape-on-comodo-container-antivirus-amp-firewallExploit, Third Party Advisory

Timeline

Published: Jul 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-142719.8In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamical CVE-2019-142725.4In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.CVE-2019-142735.3In SilverStripe assets 4.0, there is broken access control on files.CVE-2019-142745.5MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c.CVE-2019-142755.5Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.CVE-2019-142766.5WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.CVE-2019-142779.8Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injecti CVE-2019-142785.3In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.CVE-2019-14287.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), CVE-2019-142805.3In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured CVE-2019-142819.8The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.CVE-2019-142829.8The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.