Avira vulnerabilities
38 vulnerabilities
Known vulnerabilities in Avira products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 40 products.
Products
40- Antivir10 vulnerabilities
- Antivir Personal4 vulnerabilities
- Antivirus3 vulnerabilities
- Av Pack3 vulnerabilities
- Avira Security3 vulnerabilities
- Free Antivirus3 vulnerabilities
- Internet Security3 vulnerabilities
- Software Updater3 vulnerabilities
- Antivir Security Suite2 vulnerabilities
- Antivirus Server2 vulnerabilities
- Avira Prime2 vulnerabilities
- Free Security Suite2 vulnerabilities
- Prime2 vulnerabilities
- Anti Malware Sdk1 vulnerabilities
- Antivir Mailgate1 vulnerabilities
- Antivir Mailgate Suite1 vulnerabilities
- Antivir Sharepoint1 vulnerabilities
- Antivir Webgate1 vulnerabilities
- Antivir Webgate Suite1 vulnerabilities
- Antivirus Free Antivirus1 vulnerabilities
- Avira Antivirus1 vulnerabilities
- Avira Antivirus For Endpoint1 vulnerabilities
- Avira Antivirus For Small Business1 vulnerabilities
- Avira Exchange Security1 vulnerabilities
- Avira Free Security Suite1 vulnerabilities
- Avira Internet Security Suite1 vulnerabilities
- Avira Mobile Security1 vulnerabilities
- Avira Secure Backup1 vulnerabilities
- Desktop1 vulnerabilities
- Exchange Security1 vulnerabilities
- Internet Security Suite1 vulnerabilities
- Optimization Suite1 vulnerabilities
- Password Manager1 vulnerabilities
- Phantom Vpn1 vulnerabilities
- Premium Security Suite1 vulnerabilities
- Professional Security1 vulnerabilities
- Savapi1 vulnerabilities
- Total Security Suite1 vulnerabilities
- Antivir Professional0 vulnerabilities
- Management Console0 vulnerabilities
CVE-2013-4602aviraantivir_mailgate+9
EPSS score1.42%
A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine.CVE-2015-7732aviraavira_mobile_securityEPSS score1.09%
The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext.CVE-2007-2973aviraantivir+1EPSS score3.44%
Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed TAR archive.CVE-2007-2974aviraantivir+1EPSS score7.53%
Buffer overflow in the file parsing engine in Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to execute arbitrary code via a crafted LZH archive file, resulting from an "integer cast around."CVE-2007-2972aviraantivir+1EPSS score3.41%
The file parsing engine in Avira Antivir Antivirus before 7.04.00.24 allows remote attackers to cause a denial of service (application crash) via a crafted UPX compressed file, which triggers a divide-by-zero error.CVE-2007-1671aviraantivir_personalEPSS score2.02%
avpack32.dll before 7.3.0.6 in Avira AntiVir allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.CVE-2007-1673amavisamavis+10EPSS score3.18%
unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.CVE-2016-10402aviraantivirusEPSS score10.21%
Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow.CVE-2020-9320aviraanti-malware_sdk+7EPSS score2.88%
Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, Antivirus for Small Business, Exchange Security (Gateway), Internet Security Suite for Windows, Prime, Free Security Suite for Windows, and Cross Platform Anti-malware SDK. NOTE: Vendor asserts that vulnerability does not exist in productCVE-2020-12680avirafree_antivirusEPSS score0.34%
Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and thus a request such as fetchChromePasswords or fetchCredentials will succeed. NOTE: some third parties have stated that this is "not a vulnerability.CVE-2020-12254aviraantivirusEPSS score0.40%
Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink.CVE-2020-12463avirasoftware_updaterEPSS score0.45%
An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files.CVE-2020-8961avirafree_antivirusEPSS score2.05%
An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific location, and pass this event to the driver, thereby defeating the anti-virus functionality.CVE-2014-5576aviraavira_secure_backupEPSS score0.27%
The Avira Secure Backup (aka com.avira.avirabackup) application 1.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.CVE-2005-2957aviradesktopEPSS score4.04%
Stack-based buffer overflow in AVIRA Desktop for Windows 1.00.00.68 with AVPACK32.DLL 6.31.0.3, when archive scanning is enabled, allows remote attackers to execute arbitrary code via a long filename in an ACE archive.CVE-2008-6962aviraantivir+1EPSS score0.65%
Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOCTL request that overwrites a kernel pointer.CVE-2022-4294avastantivirus+7EPSS score0.19%
Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.CVE-2022-4429aviraavira_security+1EPSS score0.15%
Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78CVE-2022-28795avirapassword_managerEPSS score1.02%
A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.CVE-2022-3368aviraavira_security+1EPSS score1.07%
A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.