Vulnerability record · CVE-2011-3477 · published 19 February 2018

CVE-2011-3477: Symantec backup exec system recovery improper input validation vulnerability

Symantec · Backup Exec System Recovery

GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Norton 360, and Norton Ghost, allows local users to cause a denial of service (system crash) via unspecified vectors.

5.5 CVSS 3.0 Medium EPSS 0.62% · top 52.3% CWE-20 · Improper input validation

5.5CVSS 3.0 base score, v2 4.9

0.62%EPSS exploitation probability, 30 days

NoNot in CISA KEV

4Affected product versions listed by NVD

4References

16 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Backup Exec System Recovery Symantec

Norton 360 Symantec

Norton Ghost Symantec

System Recovery 2011 Symantec

References

Link	Tags
http://www.securityfocus.com/bid/47822	Third Party AdvisoryVDB Entry
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=	PatchVendor Advisory
http://www.securityfocus.com/bid/47822	Third Party AdvisoryVDB Entry
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=	PatchVendor Advisory

Track CVE-2011-3477 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-3645Symantec norton security vulnerabilityInteger overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:…EPSS 25%30 Jun 2016 9.3CVE-2010-0107Symantec client security memory buffer overflow vulnerabilityBuffer overflow in an ActiveX control (SYMLTCOM.dll) in Symantec N360 1.0 and 2.0; Norton Internet Security, AntiVirus, SystemWorks, and Confidential…EPSS 6.5%23 Feb 2010 9.3CVE-2008-0312Symantec norton 360 memory buffer overflow vulnerabilityStack-based buffer overflow in the AutoFix Support Tool ActiveX control 2.7.0.1 in SYMADATA.DLL in multiple Symantec Norton products, including Norto…EPSS 6.1%8 Apr 2008 8.4CVE-2016-3646Symantec norton security improper input validation vulnerabilityThe AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Syma…EPSS 18%30 Jun 2016 8.4CVE-2016-3644Symantec norton security improper input validation vulnerabilityThe AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Syma…EPSS 18%30 Jun 2016 8.4CVE-2016-2207Symantec mail security for microsoft exchange improper input validation vulnerabilityThe AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Syma…EPSS 18%30 Jun 2016 7.8CVE-2016-5311Symantec endpoint protection uncontrolled search path element vulnerabilityA Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup,…EPSS 0.71%9 Jan 2020 7.8CVE-2016-2211Symantec AntiVirus Decomposer CAB parsing memory corruptionThe AntiVirus Decomposer engine in numerous Symantec and Norton products mishandles crafted CAB files during decompression, causing a memory buffer o…EPSS 53%analysed30 Jun 2016

Source: NIST National Vulnerability Database (record CVE-2011-3477), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.