Read the docs
TI-2017-09954 Aliases CVE-2017-13676GHSA-w85q-f77r-393q

Code injection in Symantec Norton Remove & Reinstall

Priority LOW 31CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Norton Remove & Reinstall can be susceptible to a DLL preloading vulnerability. These types of issues occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application. A Norton Remove & Reinstall update, version 4.4.0.58, has been released which addresses the aforementioned vulnerability.

Why it matters now

EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Fixed Norton Remove & Reinstall (Symantec Corporation): 4.4.0.58

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton Remove & Reinstallbefore 4.4.0.584.4.0.58Patch availableCNA
  • Norton Remove & Reinstall VendorSymantec Affected before 4.4.0.58 Fixed in 4.4.0.58 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:norton:remove_\&_reinstall:*:*:*:*:*:*:*:*up to -VulnerableNorton
  • cpe:2.3:a:norton:remove_\&_reinstall:*:*:*:*:*:*:*:* Versions up to - Vulnerable ·Norton

Remediation

  • Fix · CNA Norton Remove & Reinstall (Symantec Corporation) Fixed in 4.4.0.58

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-13676
  2. 2026-10-03 Alias added: GHSA-w85q-f77r-393q

References

Advisory 1

  • TI-2017-04157 Command injection in Symantec Messaging Gateway KEVCVSS 3.1HIGH 8.8
  • TI-2009-01353 The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2)… CVSS 2.0HIGH 10.0
  • TI-2017-04156 The Symantec Messaging Gateway can encounter an issue of remote code execution, which… CVSS 3.0CRITICAL 10.0
  • TI-2012-00284 The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict… CVSS 2.0HIGH 10.0
  • TI-2006-02539 Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows… CVSS 2.0HIGH 10.0
  • TI-2012-02563 The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote… CVSS 2.0HIGH 10.0
See all 597 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences