CVE-2004-0937

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-02-09 · updated 2026-06-16

Description

Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Affected products

Archive Zip: 1.13
Broadcom Brightstor Arcserve Backup: 11.1
Broadcom Etrust Antivirus: 7.0, 7.1
Broadcom Etrust Antivirus Gateway: 7.0, 7.1
Broadcom Etrust Ez Antivirus: 6.1, 6.2, 6.3
Broadcom Etrust Ez Armor: 2.0, 2.3, 2.4
Broadcom Etrust Intrusion Detection: 1.4.1.13, 1.4.5, 1.5
Broadcom Etrust Secure Content Manager: 1.0, 1.1
Broadcom Inoculateit: 6.0
Ca Etrust Antivirus: 7.0_sp2
Ca Etrust Secure Content Manager: 1.0-sp1
Eset Software Nod32 Antivirus: 1.0.11, 1.0.12, 1.0.13
gentoo Linux: 1.4
Kaspersky Lab Kaspersky Anti-Virus: 3.0, 4.0, 5.0
Mandrakesoft Mandrake Linux: 10.1
McAfee Antivirus Engine: 4.3.20
Rav Antivirus Desktop: 8.6
Rav Antivirus For File Servers: 1.0
Rav Antivirus For Mail Servers: 8.4.2
Sophos Anti-Virus: 3.4.6, 3.78, 3.78d, 3.79, 3.80, 3.81 (+5)
Sophos Puremessage Anti-Virus: 4.6
Sophos Small Business Suite: 1.0
Suse Linux: 9.2

References

Get alerted when CVE-2004-0937 or the next vulnerability affects your stack