CVE-2017-12378: clamav Out-of-bounds Read

Vulnerability summary

CVE-2017-12378 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in clamav. EPSS estimates a 2.79% chance of exploitation in the next 30 days, higher than 86.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-01-2018
   PublishedVulnerability first disclosed.
2. 02-12-2024
   Last modifiedVulnerability information updated.

Description

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.