Vulnerability in Fransois Gannier Fileinfo Plugin
CVE-2007-4463
The Fileinfo 2.0.9 plugin for Total Commander allows user-assisted remote attackers to cause a denial of service (unhandled exception) via an invalid RVA address function pointer in (1) an IMAGE_THUNK_DATA structure, involving the (a) OriginalFirstThunk and (b) FirstThunk IMAGE_IMPORT_DESCRIPTOR fields, or (2) the AddressOfNames IMAGE_EXPORT_DIRECTORY field in a PE file.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.035 (88.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.035 · newest: 0.035 · change: 0.000
Affected products
- Fransois Gannier Fileinfo Plugin — versions 2.09
- Ghisler Total Commander
References
- exchange.xforce.ibmcloud.com/vulnerabilities/36126 (vdb-entry)
- blog.hispasec.com/lab/advisories/adv_Fileinfo-2_09_multiple_vulnerabilities.txt
- blog.hispasec.com/lab/230
- www.securityfocus.com/bid/25373 (Exploit, vdb-entry)
- www.securityfocus.com/archive/1/477170/100/0/threaded (mailing-list)
- securityreason.com/securityalert/3044 (third-party-advisory)
- osvdb.org/46835 (vdb-entry)