CVE-2007-4560

Severity: high (CVSS 7.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 83.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-08-28 · updated 2026-06-16
Weakness: CWE-78

Description

clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."

Affected products

Clam Anti-Virus Clamav: through 0.91.1

References

http://docs.info.apple.com/article.html?artnum=307562
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
http://secunia.com/advisories/26654
http://secunia.com/advisories/26674
http://secunia.com/advisories/26683
http://secunia.com/advisories/26751
http://secunia.com/advisories/26822
http://secunia.com/advisories/26916
http://secunia.com/advisories/29420
http://security.gentoo.org/glsa/glsa-200709-14.xml
http://securityreason.com/securityalert/3063
http://www.debian.org/security/2007/dsa-1366

Get alerted when CVE-2007-4560 or the next vulnerability affects your stack