Search for packages
| purl | pkg:deb/ubuntu/clamav@0.99.4%2Baddedllvm-0ubuntu0.17.10.1 |
| Next non-vulnerable version | 0.103.2+dfsg-0ubuntu0.20.04.1 |
| Latest non-vulnerable version | 0.103.2+dfsg-0ubuntu0.20.04.1 |
| Risk | 4.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-35hv-7k6q-aaag
Aliases: CVE-2020-3341 |
A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. |
Affected by 5 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-4pxy-6rjv-aaae
Aliases: CVE-2018-18584 |
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write. |
Affected by 15 other vulnerabilities. |
|
VCID-6jeh-pfrs-aaam
Aliases: CVE-2019-15961 |
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition. |
Affected by 8 other vulnerabilities. |
|
VCID-8urm-9ubj-aaac
Aliases: CVE-2019-12900 |
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. |
Affected by 9 other vulnerabilities. |
|
VCID-acxu-8qcw-aaan
Aliases: CVE-2018-14679 |
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash). |
Affected by 22 other vulnerabilities. |
|
VCID-apk2-uyhv-aaaj
Aliases: CVE-2018-15378 |
A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file. |
Affected by 19 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-euna-13at-aaac
Aliases: CVE-2019-1787 |
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-h1ts-zrpw-aaaa
Aliases: CVE-2018-0361 |
ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. |
Affected by 24 other vulnerabilities. Affected by 20 other vulnerabilities. |
|
VCID-h4pq-2v65-aaak
Aliases: CVE-2019-1788 |
A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition, resulting in a crash that could result in a denial of service condition on an affected device. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-j3u4-a9cj-aaap
Aliases: CVE-2018-14680 |
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames. |
Affected by 22 other vulnerabilities. |
|
VCID-mgh7-grv5-aaac
Aliases: CVE-2019-1786 |
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. |
Affected by 15 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-mv1b-b1cy-aaah
Aliases: CVE-2019-12625 |
ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. |
Affected by 9 other vulnerabilities. |
|
VCID-qub6-6twy-aaan
Aliases: CVE-2020-3327 |
A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. |
Affected by 5 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-rrcd-7j67-aaaf
Aliases: CVE-2018-14681 |
An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite. |
Affected by 22 other vulnerabilities. |
|
VCID-ruev-xj9h-aaab
Aliases: CVE-2018-18585 |
chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name). |
Affected by 15 other vulnerabilities. |
|
VCID-sab9-b6yn-aaaj
Aliases: CVE-2021-1252 |
A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper error handling that may result in an infinite loop. An attacker could exploit this vulnerability by sending a crafted Excel file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process hang, resulting in a denial of service condition. |
Affected by 0 other vulnerabilities. |
|
VCID-u2mu-4235-aaae
Aliases: CVE-2019-1789 |
ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE files. An example is Windows EXE and DLL files that have been packed using Aspack as a result of inadequate bound-checking. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-w7xg-sne8-aaak
Aliases: CVE-2020-3350 |
A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working. |
Affected by 3 other vulnerabilities. |
|
VCID-wam4-3wsq-aaap
Aliases: CVE-2021-1405 |
A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted email to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. |
Affected by 0 other vulnerabilities. |
|
VCID-way3-sf4b-aaaq
Aliases: CVE-2020-3123 |
A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. |
Affected by 7 other vulnerabilities. |
|
VCID-wkww-sy3w-aaad
Aliases: CVE-2020-3481 |
A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. |
Affected by 3 other vulnerabilities. |
|
VCID-xc7t-rzu4-aaap
Aliases: CVE-2019-1785 |
A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system. |
Affected by 15 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-xkwu-ahuh-aaaj
Aliases: CVE-2019-1798 |
A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. |
Affected by 15 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-xnp8-63tv-aaac
Aliases: CVE-2021-1404 |
A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition. |
Affected by 0 other vulnerabilities. |
|
VCID-yng9-6r39-aaap
Aliases: CVE-2018-14682 |
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. |
Affected by 22 other vulnerabilities. |
|
VCID-z13k-kxsj-aaae
Aliases: CVE-2018-0360 |
ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c. |
Affected by 24 other vulnerabilities. Affected by 20 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|