CVE-2014-1213: Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11,

Routine

MEDIUM 5.6UPGRADEDOWNGRADE

CVE-2014-1213 is a medium-severity flaw (CVSS 5.6) affecting scanning engine, sophos anti-virus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataU

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	5.6 (Medium)
EPSS exploit chance	1.0% (top 38%)
CISA exploited list	No
Weakness	CWE-264
Published	2014-02-10
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: sophos

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-02-10 23:55 UTCPublished CVE record published
2026-06-17 00:04 UTCUpdated Record last modified

sophos scanning engine UPGRADE

Affected: <= 3.48

Fixed in: newer than 3.48

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy scanning-engine || rpm -q scanning-engine || scanning-engine --version

2. UPGRADE to newer than 3.48 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade scanning-engine

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade scanning-engine

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

sophos sophos anti-virus DOWNGRADE

Affected: 10.0.11

Fixed in: no fixed release known

Safe to downgrade to: a release before 10.0.11

1. Check installed version

apt-cache policy sophos-anti-virus || rpm -q sophos-anti-virus || sophos-anti-virus --version

2. No fixed release: DOWNGRADE to a release before 10.0.11 (Debian / Ubuntu)

apt-cache madison sophos-anti-virus sudo apt install sophos-anti-virus=<VERSION_BEFORE_10.0.11> sudo apt-mark hold sophos-anti-virus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list sophos-anti-virus sudo dnf downgrade sophos-anti-virus-<VERSION_BEFORE_10.0.11> sudo dnf versionlock add sophos-anti-virus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-1213?

scanning engine: upgrade to newer than 3.48; sophos anti-virus: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2014-1213 being exploited?

CVE-2014-1213 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2014-1213 affect?

CVE-2014-1213 affects scanning engine, sophos anti-virus. Severity is medium (CVSS 5.6). Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-viru

How urgent is CVE-2014-1213?

Priority 35/100. No elevated risk signals yet.

Software pages

Sophos vulnerabilities

Related CVEs

CVE-2008-3447 MEDIUM 5.0 DOWNGRADE DOWNGRADE The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infin
CVE-2008-3244 MEDIUM 4.3 DOWNGRADE UPGRADE The scanning engine before 4.4.4 in F-Prot Antivirus before 6.0.9.0 allows remote attackers to cause a denial
CVE-2008-3243 MEDIUM 4.3 DOWNGRADE UPGRADE Multiple unspecified vulnerabilities in the scanning engine before 4.4.4 in F-Prot Antivirus before 6.0.9.0 al
CVE-2007-4787 MEDIUM 5.0 DOWNGRADE DOWNGRADE The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2)
CVE-2007-4578 MEDIUM 6.8 DOWNGRADE DOWNGRADE Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of se

References

← Back to latest CVEs