CVE-2012-1424: The TAR file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Jiangmin Antivirus 13

This week

MEDIUM 4.3DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2012-1424 is a medium-severity flaw (CVSS 4.3) affecting avl sdk, quick heal, jiangmin antivirus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The TAR file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Jiangmin Antivirus 13.0.900, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \19\04\00\10 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occ

Why this priority

EPSS top 1%: very likely to be exploited

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	4.3 (Medium)
EPSS exploit chance	87.3% (top 1%)
CISA exploited list	No
Weakness	CWE-264
Published	2012-03-21
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: antiy · cat · jiangmin · norman · pc tools · sophos

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2012-03-21 10:11 UTCPublished CVE record published
2026-06-16 23:39 UTCUpdated Record last modified

antiy avl sdk DOWNGRADE

Affected: 2.0.3.7

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.0.3.7

1. Check installed version

apt-cache policy avl-sdk || rpm -q avl-sdk || avl-sdk --version

2. No fixed release: DOWNGRADE to a release before 2.0.3.7 (Debian / Ubuntu)

apt-cache madison avl-sdk sudo apt install avl-sdk=<VERSION_BEFORE_2.0.3.7> sudo apt-mark hold avl-sdk

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list avl-sdk sudo dnf downgrade avl-sdk-<VERSION_BEFORE_2.0.3.7> sudo dnf versionlock add avl-sdk

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

cat quick heal DOWNGRADE

Affected: 11.00

Fixed in: no fixed release known

Safe to downgrade to: a release before 11.00

1. Check installed version

apt-cache policy quick-heal || rpm -q quick-heal || quick-heal --version

2. No fixed release: DOWNGRADE to a release before 11.00 (Debian / Ubuntu)

apt-cache madison quick-heal sudo apt install quick-heal=<VERSION_BEFORE_11.00> sudo apt-mark hold quick-heal

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list quick-heal sudo dnf downgrade quick-heal-<VERSION_BEFORE_11.00> sudo dnf versionlock add quick-heal

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

jiangmin jiangmin antivirus DOWNGRADE

Affected: 13.0.900

Fixed in: no fixed release known

Safe to downgrade to: a release before 13.0.900

1. Check installed version

apt-cache policy jiangmin-antivirus || rpm -q jiangmin-antivirus || jiangmin-antivirus --version

2. No fixed release: DOWNGRADE to a release before 13.0.900 (Debian / Ubuntu)

apt-cache madison jiangmin-antivirus sudo apt install jiangmin-antivirus=<VERSION_BEFORE_13.0.900> sudo apt-mark hold jiangmin-antivirus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list jiangmin-antivirus sudo dnf downgrade jiangmin-antivirus-<VERSION_BEFORE_13.0.900> sudo dnf versionlock add jiangmin-antivirus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

norman norman antivirus \& antispyware DOWNGRADE

Affected: 6.06.12

Fixed in: no fixed release known

Safe to downgrade to: a release before 6.06.12

1. Check installed version

apt-cache policy norman-antivirus--antispyware || rpm -q norman-antivirus--antispyware || norman-antivirus--antispyware --version

2. No fixed release: DOWNGRADE to a release before 6.06.12 (Debian / Ubuntu)

apt-cache madison norman-antivirus--antispyware sudo apt install norman-antivirus--antispyware=<VERSION_BEFORE_6.06.12> sudo apt-mark hold norman-antivirus--antispyware

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list norman-antivirus--antispyware sudo dnf downgrade norman-antivirus--antispyware-<VERSION_BEFORE_6.06.12> sudo dnf versionlock add norman-antivirus--antispyware

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

pc tools pc tools antivirus DOWNGRADE

Affected: 7.0.3.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.0.3.5

1. Check installed version

apt-cache policy pc-tools-antivirus || rpm -q pc-tools-antivirus || pc-tools-antivirus --version

2. No fixed release: DOWNGRADE to a release before 7.0.3.5 (Debian / Ubuntu)

apt-cache madison pc-tools-antivirus sudo apt install pc-tools-antivirus=<VERSION_BEFORE_7.0.3.5> sudo apt-mark hold pc-tools-antivirus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list pc-tools-antivirus sudo dnf downgrade pc-tools-antivirus-<VERSION_BEFORE_7.0.3.5> sudo dnf versionlock add pc-tools-antivirus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

sophos sophos anti-virus DOWNGRADE

Affected: 4.61.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.61.0

1. Check installed version

apt-cache policy sophos-anti-virus || rpm -q sophos-anti-virus || sophos-anti-virus --version

2. No fixed release: DOWNGRADE to a release before 4.61.0 (Debian / Ubuntu)

apt-cache madison sophos-anti-virus sudo apt install sophos-anti-virus=<VERSION_BEFORE_4.61.0> sudo apt-mark hold sophos-anti-virus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list sophos-anti-virus sudo dnf downgrade sophos-anti-virus-<VERSION_BEFORE_4.61.0> sudo dnf versionlock add sophos-anti-virus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2012-1424?

avl sdk: downgrade or apply the listed mitigation; quick heal: downgrade or apply the listed mitigation; jiangmin antivirus: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2012-1424 being exploited?

CVE-2012-1424 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2012-1424 affect?

CVE-2012-1424 affects avl sdk, quick heal, jiangmin antivirus. Severity is medium (CVSS 4.3). The TAR file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Jiangmin Antivirus 13.0.900, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malwa

How urgent is CVE-2012-1424?

Priority 40/100. EPSS top 1%: very likely to be exploited

Software pages

Sophos vulnerabilities

Related CVEs

CVE-2012-1460 MEDIUM 4.3 DOWNGRADE DOWNGRADE The Gzip file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.
CVE-2012-1459 MEDIUM 4.3 DOWNGRADE DOWNGRADE The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK
CVE-2012-1457 MEDIUM 4.3 DOWNGRADE DOWNGRADE The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5
CVE-2012-1453 MEDIUM 4.3 DOWNGRADE DOWNGRADE The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125,
CVE-2012-1446 MEDIUM 4.3 DOWNGRADE DOWNGRADE The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, A

References

← Back to latest CVEs