Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2007-3875: arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows

37
Routine
MEDIUM 4.3DOWNGRADEUPGRADEMITIGATE

CVE-2007-3875 is a medium-severity flaw (CVSS 4.3) affecting anti-spyware, anti-virus for the enterprise, anti virus sdk. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows remote attackers to cause a denial of service (infinite loop and loss of antivirus functionality) via an invalid "previous listing chunk number" field in a CHM file.

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score4.3 (Medium)
EPSS exploit chance3.6% (top 11%)
CISA exploited listNo
Published2007-07-26
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: broadcom

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

broadcom anti-spyware DOWNGRADE
Affected: 2007
Fixed in: no fixed release known
Safe to downgrade to: a release before 2007
1. Check installed version
apt-cache policy anti-spyware || rpm -q anti-spyware || anti-spyware --version
2. No fixed release: DOWNGRADE to a release before 2007 (Debian / Ubuntu)
apt-cache madison anti-spyware sudo apt install anti-spyware=<VERSION_BEFORE_2007> sudo apt-mark hold anti-spyware
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list anti-spyware sudo dnf downgrade anti-spyware-<VERSION_BEFORE_2007> sudo dnf versionlock add anti-spyware
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom anti-virus for the enterprise UPGRADE
Affected: <= 8 · 7.0 · 7.1 · 8 · 8.1
Fixed in: newer than 8
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy anti-virus-for-the-enterprise || rpm -q anti-virus-for-the-enterprise || anti-virus-for-the-enterprise --version
2. UPGRADE to newer than 8 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade anti-virus-for-the-enterprise
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade anti-virus-for-the-enterprise
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
broadcom anti virus sdk MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy anti-virus-sdk || rpm -q anti-virus-sdk || anti-virus-sdk --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
broadcom antispyware for the enterprise DOWNGRADE
Affected: 8 · 8.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 8
1. Check installed version
apt-cache policy antispyware-for-the-enterprise || rpm -q antispyware-for-the-enterprise || antispyware-for-the-enterprise --version
2. No fixed release: DOWNGRADE to a release before 8 (Debian / Ubuntu)
apt-cache madison antispyware-for-the-enterprise sudo apt install antispyware-for-the-enterprise=<VERSION_BEFORE_8> sudo apt-mark hold antispyware-for-the-enterprise
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list antispyware-for-the-enterprise sudo dnf downgrade antispyware-for-the-enterprise-<VERSION_BEFORE_8> sudo dnf versionlock add antispyware-for-the-enterprise
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom antivirus sdk MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy antivirus-sdk || rpm -q antivirus-sdk || antivirus-sdk --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
broadcom brightstor arcserve backup DOWNGRADE
Affected: 9.01 · 11.1 · 11.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.01
1. Check installed version
apt-cache policy brightstor-arcserve-backup || rpm -q brightstor-arcserve-backup || brightstor-arcserve-backup --version
2. No fixed release: DOWNGRADE to a release before 9.01 (Debian / Ubuntu)
apt-cache madison brightstor-arcserve-backup sudo apt install brightstor-arcserve-backup=<VERSION_BEFORE_9.01> sudo apt-mark hold brightstor-arcserve-backup
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list brightstor-arcserve-backup sudo dnf downgrade brightstor-arcserve-backup-<VERSION_BEFORE_9.01> sudo dnf versionlock add brightstor-arcserve-backup
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-3875?

anti-spyware: downgrade or apply the listed mitigation; anti-virus for the enterprise: upgrade to newer than 8; anti virus sdk: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2007-3875 being exploited?

CVE-2007-3875 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-3875 affect?

CVE-2007-3875 affects anti-spyware, anti-virus for the enterprise, anti virus sdk. Severity is medium (CVSS 4.3). arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows remote attackers to cause a denial of service (infinite loop and loss of antivirus functionality) via an invalid "previous listing

How urgent is CVE-2007-3875?

Priority 37/100. No elevated risk signals yet.

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.