ClamAV - Multiple Vulnerabilities
Summary
DLA-1261-1: clamav - security update. Affects clamav versions < 0.99.2+dfsg-0+deb7u4. Fixed in 0.99.2+dfsg-0+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus toolkit designed for Unix systems. It provides protection against various types of malware and is commonly used to scan email attachments and files for potential threats. However, multiple vulnerabilities have been discovered in ClamAV, which could lead to denial of service or even arbitrary code execution. These vulnerabilities affect ClamAV versions prior to 0.99.2+dfsg-0+deb7u4.
Vulnerability Detail
The vulnerabilities in ClamAV include:
- CVE-2017-12374: A use-after-free condition that can be exploited by a remote attacker with a crafted email message, leading to a denial of service.
- CVE-2017-12375: A buffer overflow vulnerability triggered by a crafted email message, potentially causing a denial of service when the message is scanned.
- CVE-2017-12376: A buffer overflow vulnerability in the handling of PDF files, which can be exploited by an attacker sending a crafted PDF file to trigger a denial of service or arbitrary code execution.
- CVE-2017-12377: A heap overflow vulnerability in the handling of mew packets, which can be exploited by sending a crafted message to trigger a denial of service or possible arbitrary code execution.
- CVE-2017-12378: A buffer overread vulnerability in the handling of TAR files, which can be triggered by a crafted TAR file and potentially result in a denial of service.
- CVE-2017-12379: A buffer overflow vulnerability in the message parsing function, exploitable through a crafted email message, leading to a denial of service or arbitrary code execution.
- CVE-2017-12380: A NULL dereference vulnerability in the message parsing function, triggered by a crafted email message, potentially resulting in a denial of service.
These vulnerabilities pose a significant risk to systems running vulnerable versions of ClamAV, as they can be exploited remotely by unauthenticated attackers.
How To Fix
Minimum fixed version
0.99.2+dfsg-0+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple vulnerabilities have been discovered in ClamAV, which could lead to denial of service or arbitrary code execution. It is crucial to upgrade to the latest version of ClamAV (0.99.2+dfsg-0+deb7u4 or later) to mitigate these risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clamav →
FAQ
ClamAV is an open-source antivirus toolkit used to scan email attachments and files for potential malware threats on Unix systems.
There are multiple vulnerabilities in ClamAV, including use-after-free, buffer overflow, heap overflow, buffer overread, and NULL dereference vulnerabilities. These vulnerabilities can be exploited remotely by unauthenticated attackers.
The impact of these vulnerabilities can range from denial of service to potential arbitrary code execution. Attackers can exploit these vulnerabilities by sending crafted email messages or files to the affected system, potentially leading to system crashes or unauthorized code execution.
To fix these vulnerabilities, it is recommended to upgrade ClamAV to version 0.99.2+dfsg-0+deb7u4 or later. This version includes patches that address the identified vulnerabilities.
You can obtain the updated ClamAV package from the official Debian repositories or through the package manager of your Unix system.
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
