PatchTheCVECVE-2006-6619: AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment Block (PEB) to identify a process, whic
46
This month
HIGH 7.2DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2006-6619 is a high-severity flaw (CVSS 7.2) affecting antivirus plus firewall, comodo personal firewall, personal firewall. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
Why this priority
- High severity
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.2 (High) |
| EPSS exploit chance | 1.0% (top 37%) |
| CISA exploited list | No |
| Published | 2006-12-18 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
avg antivirus plus firewall DOWNGRADE
Affected: 7.5.431
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.5.431
1. Check installed version
apt-cache policy antivirus-plus-firewall || rpm -q antivirus-plus-firewall || antivirus-plus-firewall --version
2. No fixed release: DOWNGRADE to a release before 7.5.431 (Debian / Ubuntu)
apt-cache madison antivirus-plus-firewall
sudo apt install antivirus-plus-firewall=<VERSION_BEFORE_7.5.431>
sudo apt-mark hold antivirus-plus-firewall
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list antivirus-plus-firewall
sudo dnf downgrade antivirus-plus-firewall-<VERSION_BEFORE_7.5.431>
sudo dnf versionlock add antivirus-plus-firewall
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
comodo comodo personal firewall DOWNGRADE
Affected: 2.3.6.81
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.3.6.81
1. Check installed version
apt-cache policy comodo-personal-firewall || rpm -q comodo-personal-firewall || comodo-personal-firewall --version
2. No fixed release: DOWNGRADE to a release before 2.3.6.81 (Debian / Ubuntu)
apt-cache madison comodo-personal-firewall
sudo apt install comodo-personal-firewall=<VERSION_BEFORE_2.3.6.81>
sudo apt-mark hold comodo-personal-firewall
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list comodo-personal-firewall
sudo dnf downgrade comodo-personal-firewall-<VERSION_BEFORE_2.3.6.81>
sudo dnf versionlock add comodo-personal-firewall
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
filseclab personal firewall DOWNGRADE
Affected: 3.0.8686
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0.8686
1. Check installed version
apt-cache policy personal-firewall || rpm -q personal-firewall || personal-firewall --version
2. No fixed release: DOWNGRADE to a release before 3.0.8686 (Debian / Ubuntu)
apt-cache madison personal-firewall
sudo apt install personal-firewall=<VERSION_BEFORE_3.0.8686>
sudo apt-mark hold personal-firewall
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list personal-firewall
sudo dnf downgrade personal-firewall-<VERSION_BEFORE_3.0.8686>
sudo dnf versionlock add personal-firewall
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
infoprocess antihook DOWNGRADE
Affected: 3.0.23
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0.23
1. Check installed version
apt-cache policy antihook || rpm -q antihook || antihook --version
2. No fixed release: DOWNGRADE to a release before 3.0.23 (Debian / Ubuntu)
apt-cache madison antihook
sudo apt install antihook=<VERSION_BEFORE_3.0.23>
sudo apt-mark hold antihook
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list antihook
sudo dnf downgrade antihook-<VERSION_BEFORE_3.0.23>
sudo dnf versionlock add antihook
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
soft4ever look n stop DOWNGRADE
Affected: 2.05p2
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.05p2
1. Check installed version
apt-cache policy look-n-stop || rpm -q look-n-stop || look-n-stop --version
2. No fixed release: DOWNGRADE to a release before 2.05p2 (Debian / Ubuntu)
apt-cache madison look-n-stop
sudo apt install look-n-stop=<VERSION_BEFORE_2.05p2>
sudo apt-mark hold look-n-stop
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list look-n-stop
sudo dnf downgrade look-n-stop-<VERSION_BEFORE_2.05p2>
sudo dnf versionlock add look-n-stop
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
symantec sygate personal firewall DOWNGRADE
Affected: 5.6.2808
Fixed in: no fixed release known
Safe to downgrade to: a release before 5.6.2808
1. Check installed version
apt-cache policy sygate-personal-firewall || rpm -q sygate-personal-firewall || sygate-personal-firewall --version
2. No fixed release: DOWNGRADE to a release before 5.6.2808 (Debian / Ubuntu)
apt-cache madison sygate-personal-firewall
sudo apt install sygate-personal-firewall=<VERSION_BEFORE_5.6.2808>
sudo apt-mark hold sygate-personal-firewall
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sygate-personal-firewall
sudo dnf downgrade sygate-personal-firewall-<VERSION_BEFORE_5.6.2808>
sudo dnf versionlock add sygate-personal-firewall
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: Multiple Vendor Firewall - HIPS Process Spoofing
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2006-6619?
antivirus plus firewall: downgrade or apply the listed mitigation; comodo personal firewall: downgrade or apply the listed mitigation; personal firewall: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2006-6619 being exploited?
CVE-2006-6619 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2006-6619 affect?
CVE-2006-6619 affects antivirus plus firewall, comodo personal firewall, personal firewall. Severity is high (CVSS 7.2). AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) Win
How urgent is CVE-2006-6619?
Priority 46/100. High severity; Public exploit reference
Software pages
Symantec and Broadcom vulnerabilities
Related CVEs
- CVE-2006-6623 HIGH 7.2 DOWNGRADE DOWNGRADE Sygate Personal Firewall 5.6.2808 relies on the Process Environment Block (PEB) to identify a process, which a
- CVE-2006-6622 HIGH 7.2 DOWNGRADE DOWNGRADE Soft4Ever Look 'n' Stop (LnS) 2.05p2 before 20061215 relies on the Process Environment Block (PEB) to identify
- CVE-2006-6621 HIGH 7.2 DOWNGRADE DOWNGRADE Filseclab Personal Firewall 3.0.0.8686 relies on the Process Environment Block (PEB) to identify a process, wh
- CVE-2006-6620 HIGH 7.2 DOWNGRADE DOWNGRADE Comodo Personal Firewall 2.3.6.81 relies on the Process Environment Block (PEB) to identify a process, which a
- CVE-2006-6618 HIGH 7.2 DOWNGRADE DOWNGRADE AntiHook 3.0.0.23 - Desktop relies on the Process Environment Block (PEB) to identify a process, which allows