Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2016-3646 Details

Description

The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted ZIP archive that is mishandled during decompression.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.4 HIGHVector:CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.exploit-db.com/exploits/40036/	CVE	Third Party AdvisoryVDB Entry
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00	CVE	Vendor Advisory
http://www.securityfocus.com/bid/91435	CVE	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1036198	CVE	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1036199	CVE	Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/40036/	[email protected]	Third Party AdvisoryVDB Entry
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00	[email protected]	Vendor Advisory
http://www.securityfocus.com/bid/91435	[email protected]	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1036198	[email protected]	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1036199	[email protected]	Third Party AdvisoryVDB Entry

see all 10 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-20	Improper Input Validation	[email protected]

Affected Products

Product	Versions
symantec norton security	<= 13.0.1
CPE cpe:2.3:a:symantec:norton_security::::::macos::* cpe:2.3:a:symantec:norton_security:::::::: Remediation No remediation found in references.
symantec protection engine	>= 7.0.0, <= 7.0.5 >= 7.5.0, <= 7.5.4 7.8.0
CPE cpe:2.3:a:symantec:protection_engine:::::::: cpe:2.3:a:symantec:protection_engine:7.8.0:::::::* Remediation No remediation found in references.
symantec advanced threat protection	<= 2.0.3
CPE cpe:2.3:a:symantec:advanced_threat_protection:::::::: Remediation No remediation found in references.
symantec norton bootable removal tool	<= 2016.0
CPE cpe:2.3:a:symantec:norton_bootable_removal_tool:::::::: Remediation No remediation found in references.
symantec data center security server	6.0 6.0 mp1 6.5 6.5 mp1 6.6
CPE cpe:2.3:a:symantec:data_center_security_server:6.0:::::::* cpe:2.3:a:symantec:data_center_security_server:6.0:mp1:::::: cpe:2.3:a:symantec:data_center_security_server:6.5:::::::* cpe:2.3:a:symantec:data_center_security_server:6.5:mp1:::::: cpe:2.3:a:symantec:data_center_security_server:6.6:::::::* cpe:2.3:a:symantec:data_center_security_server:6.6:mp1:::::: Remediation No remediation found in references.
symantec protection for sharepoint servers	>= 6.0, <= 6.0.6 >= 6.03, <= 6.05
CPE cpe:2.3:a:symantec:protection_for_sharepoint_servers:::::::: Remediation No remediation found in references.
symantec message gateway for service providers	10.5 10.6
CPE cpe:2.3:a:symantec:message_gateway_for_service_providers:10.5:::::::* cpe:2.3:a:symantec:message_gateway_for_service_providers:10.6:::::::* Remediation No remediation found in references.
symantec csapi	<= 10.0.4
CPE cpe:2.3:a:symantec:csapi:::::::: Remediation No remediation found in references.
symantec endpoint protection	12.1.6 12.1.6 mp1 12.1.6 mp2 12.1.6 mp3 12.1.6 mp4
CPE cpe:2.3:a:symantec:endpoint_protection:12.1.6:::::::* cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp1:::::: cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp2:::::: cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp3:::::: cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4:::::: cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4::::linux::* cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4::::macos::* Remediation No remediation found in references.
symantec norton power eraser	<= 5.0
CPE cpe:2.3:a:symantec:norton_power_eraser:::::::: Remediation No remediation found in references.
symantec mail security for domino	>= 8.0, <= 8.0.9 >= 8.1, <= 8.1.3
CPE cpe:2.3:a:symantec:mail_security_for_domino:::::::: Remediation No remediation found in references.
symantec mail security for microsoft exchange	>= 7.0, <= 7.0.4 >= 7.5, <= 7.5.4 6.5.8
CPE cpe:2.3:a:symantec:mail_security_for_microsoft_exchange:::::::: cpe:2.3:a:symantec:mail_security_for_microsoft_exchange:6.5.8:::::::* Remediation No remediation found in references.
symantec message gateway	<= 10.6.1-3
CPE cpe:2.3:a:symantec:message_gateway:::::::: Remediation No remediation found in references.
symantec norton 360	All versions
CPE cpe:2.3:a:symantec:norton_360:::::::: Remediation No remediation found in references.
symantec norton antivirus	All versions
CPE cpe:2.3:a:symantec:norton_antivirus:::::::: Remediation No remediation found in references.
symantec norton internet security	All versions
CPE cpe:2.3:a:symantec:norton_internet_security:::::::: Remediation No remediation found in references.
symantec norton security with backup	All versions
CPE cpe:2.3:a:symantec:norton_security_with_backup:::::::: Remediation No remediation found in references.
symantec ngc	<= 22.6
CPE cpe:2.3:a:symantec:ngc:::::::: Remediation No remediation found in references.

Change History

14 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
May 6, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
May 11, 2020	CPE Deprecation Remap	[email protected]
May 11, 2020	CPE Deprecation Remap	[email protected]
Jul 16, 2019	Modified Analysis	[email protected]
Oct 30, 2018	CPE Deprecation Remap	[email protected]
Oct 30, 2018	CPE Deprecation Remap	[email protected]
Sep 3, 2017	CVE Modified	[email protected]
Sep 1, 2017	CVE Modified	[email protected]
Sep 9, 2016	Modified Analysis	[email protected]
Jul 6, 2016	Modified Analysis	[email protected]
Jul 6, 2016	Initial Analysis	[email protected]

CVE-2016-3646 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO