MGASA-2017-0363: clamav Mageia
CVSS: UnknownPublished
Published 09-10-2017Last modified 16-04-2026
Vulnerability summary
MGASA-2017-0363 is a vulnerability in clamav Mageia with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 09-10-2017PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated clamav packages fix security vulnerability A malformed xar file can cause an out of bounds heap read in clamav.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia2 products
- clamav< 0.99.2-1.2.mga5
- clamav< 0.99.2-2.3.mga6
1 vendor · 2 products
References
3 linksRelated vulnerabilities
MGASA-2019-0162mageiaclamavUpdated clamav packages fix security vulnerabilities
The updated packages fix security vulnerabilities:
A vulnerability in the Portable Document Format (PDF) scanning functionality
of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow
an unauthenticated, remote attacker to cause a denial of service (DoS)
condition on an affected device. The vulnerability is due to a lack of
proper data handling mechanisms within the device buffer while indexing
remaining file data on an affected device. An attacker could exploit this
vulnerability by sending crafted PDF files to an affected device. A
successful exploit could allow the attacker to cause a heap buffer
out-of-bounds read condition, resulting in a crash that could result in a
denial of service condition on an affected device. (CVE-2019-1787)
A vulnerability in the Object Linking & Embedding (OLE2) file scanning
functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior
could allow an unauthenticated, remote attacker to cause a denial of service
condition on an affected device. The vulnerability is due to a lack of
proper input and validation checking mechanisms for OLE2 files sent an
affected device. An attacker could exploit this vulnerability by sending
malformed OLE2 files to the device running an affected version ClamAV
Software. An exploit could allow the attacker to cause an out-of-bounds
write condition, resulting in a crash that could result in a denial of
service condition on an affected device. (CVE-2019-1788)
An out-of-bounds heap read condition when scanning PE files. (CVE-2019-1789)MGASA-2018-0317mageiaclamavUpdated clamav packages fix security vulnerabilities
ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite
loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph()
in libclamav/hwp.c. (CVE-2018-0360)
ClamAV before 0.100.1 lacks a PDF object length check, resulting in an
unreasonably long time to parse a relatively small file. (CVE-2018-0361)MGASA-2018-0169mageiaclamavUpdated clamav packages fix security vulnerabilities
Clamav has been updated to fix 2 security issues and also contains a lot of
bugfixes.
Out-of-bounds access in the PDF parser (CVE-2018-0202)
Out-of-bounds heap read in XAR parser (CVE-2018-1000085)MGASA-2018-0117mageiaclamavUpdated clamav packages fix security vulnerability
The ClamAV AntiVirus software versions 0.99.2 and prior contain a
vulnerability that could allow an unauthenticated, remote attacker to
cause a denial of service (DoS) condition on an affected device. The
vulnerability is due to a lack of input validation checking mechanisms
during certain mail parsing operations (mbox.c operations on bounce
messages). If successfully exploited, the ClamAV software could allow a
variable pointing to the mail body which could cause a used after being
free (use-after-free) instance which may lead to a disruption of services
on an affected device to include a denial of service condition.
(CVE-2017-12374)
The ClamAV AntiVirus software versions 0.99.2 and prior contain a
vulnerability that could allow an unauthenticated, remote attacker to
cause a denial of service (DoS) condition on an affected device. The
vulnerability is due to a lack of input validation checking mechanisms
during certain mail parsing functions (the rfc2047 function in mbox.c). An
unauthenticated, remote attacker could exploit this vulnerability by
sending a crafted email to the affected device. This action could cause a
buffer overflow condition when ClamAV scans the malicious email, allowing
the attacker to potentially cause a DoS condition on an affected device.
(CVE-2017-12375)
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability
that could allow an unauthenticated, remote attacker to cause a denial of
service (DoS) condition or potentially execute arbitrary code on an affected
device. The vulnerability is due to improper input validation checking
mechanisms when handling Portable Document Format (.pdf) files sent to an
affected device. An unauthenticated, remote attacker could exploit this
vulnerability by sending a crafted .pdf file to an affected device. This
action could cause a handle_pdfname (in pdf.c) buffer overflow when ClamAV
scans the malicious file, allowing the attacker to cause a DoS condition
or potentially execute arbitrary code. (CVE-2017-12376)
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability
that could allow an unauthenticated, remote attacker to cause a denial of
service (DoS) condition or potentially execute arbitrary code on an affected
device. The vulnerability is due to improper input validation checking
mechanisms in mew packet files sent to an affected device. A successful
exploit could cause a heap-based buffer over-read condition in mew.c when
ClamAV scans the malicious file, allowing the attacker to cause a DoS
condition or potentially execute arbitrary code on the affected device.
(CVE-2017-12377)
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability
that could allow an unauthenticated, remote attacker to cause a denial of
service (DoS) condition on an affected device. The vulnerability is due to
improper input validation checking mechanisms of .tar (Tape Archive) files
sent to an affected device. A successful exploit could cause a checksum
buffer over-read condition when ClamAV scans the malicious .tar file,
potentially allowing the attacker to cause a DoS condition on the affected
device. (CVE-2017-12378)
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability
that could allow an unauthenticated, remote attacker to cause a denial of
service (DoS) condition or potentially execute arbitrary code on an affected
device. The vulnerability is due to improper input validation checking
mechanisms in the message parsing function on an affected system. An
unauthenticated, remote attacker could exploit this vulnerability by sending
a crafted email to the affected device. This action could cause a
messageAddArgument (in message.c) buffer overflow condition when ClamAV
scans the malicious email, allowing the attacker to potentially cause a DoS
condition or execute arbitrary code on an affected device. (CVE-2017-12379)
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability
that could allow an unauthenticated, remote attacker to cause a denial of
service (DoS) condition on an affected device. The vulnerability is due to
improper input validation checking mechanisms in mbox.c during certain mail
parsing functions of the ClamAV software. An unauthenticated, remote
attacker could exploit this vulnerability by sending a crafted email to the
affected device. An exploit could trigger a NULL pointer dereference
condition when ClamAV scans the malicious email, which may result in a DoS
condition. (CVE-2017-12380)MGASA-2017-0291mageiaclamav+1Updated clamav packages fix security vulnerabilities
It was discovered that ClamAV incorrectly handled parsing certain e-mail
messages. A remote attacker could possibly use this issue to cause
ClamAV to crash, resulting in a denial of service (CVE-2017-6418).
It was discovered that ClamAV incorrectly handled parsing certain PE
files with WWPack compression. A remote attacker could possibly use this
issue to cause ClamAV to crash, resulting in a denial of service
(CVE-2017-6420).MGASA-2016-0402mageiaclamavUpdated clamav packages fix security vulnerability
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause
a denial of service (application crash) via a crafted mew packer
executable (CVE-2016-1371).
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause
a denial of service (application crash) via a crafted 7z file
(CVE-2016-1372).
libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware
Protection (AMP) on Cisco Email Security Appliance (ESA) devices before
9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and
9.1.x before 9.1.1-041, allows remote attackers to cause a denial of
service (AMP process restart) via a crafted document (CVE-2016-1405).
The clavav package has been updated to version 0.99.2, fixing these issues
and other bugs. See the upstream release announcements for details.