What is CVE-2019-3970?

CVE-2019-3970 is a medium-severity vulnerability in Comodo Antivirus, classified under Exposure of Resource to Wrong Sphere. CVSS score: 5.5/10. Published 2019-07-17.

How severe is CVE-2019-3970?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Comodo Antivirus

CVE-2019-3970

Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Arbitrary File Write due to Cavwp.exe handling of Comodo's Antivirus database. Cavwp.exe loads Comodo antivirus definition database in unsecured global section objects, allowing a local low privileged process to modify this data directly and change virus signatures.

EPSS: 0.004 (32.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Comodo Antivirus
N/a Comodo Antivirus — versions Versions 12.0.0.6810 and below

Weakness classification (CWE)

CWE-668 — Exposure of Resource to Wrong Sphere

References

vulnreport@tenable.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-3970?: CVE-2019-3970 is a medium-severity vulnerability in Comodo Antivirus, classified under Exposure of Resource to Wrong Sphere. CVSS score: 5.5/10. Published 2019-07-17.
How severe is CVE-2019-3970?: Medium severity. CVSS v3 base score is 5.5 out of 10.