CVE-2007-2352

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-04-30 · updated 2026-06-16

Description

Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls, possibly involving (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d) tools/afinfo.cpp, (e) aimage/imager.cpp, and (f) tools/afxml.cpp. NOTE: this identifier is intended to address the vectors that were not fixed in CVE-2007-2054, but the unfixed vectors were not explicitly listed.

Affected products

Afflib: through 2.2.6

References

http://securityreason.com/securityalert/2657
http://www.securityfocus.com/archive/1/467040/100/0/threaded
http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt
http://securityreason.com/securityalert/2657
http://www.securityfocus.com/archive/1/467040/100/0/threaded
http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt

Get alerted when CVE-2007-2352 or the next vulnerability affects your stack