Search for vulnerabilities
Vulnerability details: VCID-2t9k-dfny-aaar
Vulnerability ID VCID-2t9k-dfny-aaar
Aliases CVE-2006-4018
Summary Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values.
Status Published
Exploitability 2.0
Weighted Severity 6.8
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
System Score Found at
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.35911 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.41846 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.44036 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.61777 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.61777 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.61777 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.61777 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
epss 0.87490 https://api.first.org/data/v1/epss?cve=CVE-2006-4018
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2006-4018
Reference id Reference type URL
http://kolab.org/security/kolab-vendor-notice-10.txt
https://api.first.org/data/v1/epss?cve=CVE-2006-4018
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4018
http://secunia.com/advisories/21368
http://secunia.com/advisories/21374
http://secunia.com/advisories/21433
http://secunia.com/advisories/21443
http://secunia.com/advisories/21457
http://secunia.com/advisories/21497
http://secunia.com/advisories/21562
http://security.gentoo.org/glsa/glsa-200608-13.xml
http://securitytracker.com/id?1016645
https://exchange.xforce.ibmcloud.com/vulnerabilities/28286
http://www.clamav.net/security/0.88.4.html
http://www.debian.org/security/2006/dsa-1153
http://www.mandriva.com/security/advisories?name=MDKSA-2006:138
http://www.novell.com/linux/security/advisories/2006_46_clamav.html
http://www.overflow.pl/adv/clamav_upx_heap.txt
http://www.securityfocus.com/archive/1/442681/100/0/threaded
http://www.securityfocus.com/bid/19381
http://www.trustix.org/errata/2006/0046/
http://www.vupen.com/english/advisories/2006/3175
http://www.vupen.com/english/advisories/2006/3275
382004 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=382004
cpe:2.3:a:clamav:clamav:0.81:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.81:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.81:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.81:rc1:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.82:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.82:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.83:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.83:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.84:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.84:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.84:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.84:rc1:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.84:rc2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.84:rc2:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.85:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.85:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.85.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.85.1:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.86:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.86:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.86.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.86.1:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.86.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.86.2:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.86:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.86:rc1:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.87:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.87:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.87.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.87.1:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.88:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.88:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.88.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.88.1:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.88.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.88.2:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.88.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.88.3:*:*:*:*:*:*:*
CVE-2006-4018 https://nvd.nist.gov/vuln/detail/CVE-2006-4018
CVE-2006-4018;OSVDB-27809 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/dos/28348.txt
CVE-2006-4018;OSVDB-27809 Exploit https://www.securityfocus.com/bid/19381/info
GLSA-200608-13 https://security.gentoo.org/glsa/200608-13
Data source Exploit-DB
Date added Aug. 7, 2006
Description Clam Anti-Virus ClamAV 0.88.x - UPX Compressed PE File Heap Buffer Overflow
Ransomware campaign use Known
Source publication date Aug. 7, 2006
Exploit type dos
Platform linux
Source update date Sept. 24, 2013
Source URL https://www.securityfocus.com/bid/19381/info
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2006-4018
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.9676
EPSS Score 0.35911
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.