Search for vulnerabilities
Vulnerability details: VCID-hzh4-271t-aaan
Vulnerability ID VCID-hzh4-271t-aaan
Aliases CVE-2010-1640
Summary Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers to cause a denial of service (crash) via a crafted PE icon that triggers an out-of-bounds read, related to improper rounding during scaling.
Status Published
Exploitability 0.5
Weighted Severity 5.5
Risk 2.8
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-189 Numeric Errors
CWE-193 Off-by-one Error
System Score Found at
cvssv3.1 6.1 http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02005 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02343 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02475 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02475 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02475 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.02475 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
epss 0.04616 https://api.first.org/data/v1/epss?cve=CVE-2010-1640
rhbs low https://bugzilla.redhat.com/show_bug.cgi?id=597358
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2010-1640
Reference id Reference type URL
http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blobdiff%3Bf=libclamav/pe_icons.c%3Bh=3f1bc5be69d0f9d84e576814d1a3cc6f40c4ff2c%3Bhp=39a714f05968f9e929576bf171dd0eb58bf06bef%3Bhb=7f0e3bbf77382d9782e0189bf80f5f59a95779b3%3Bhpb=f0eb394501ec21b9fe67f36cbf5db788711d4236
http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96.1
http://git.clamav.net/gitweb?p=clamav-devel.git;a=blobdiff;f=libclamav/pe_icons.c;h=3f1bc5be69d0f9d84e576814d1a3cc6f40c4ff2c;hp=39a714f05968f9e929576bf171dd0eb58bf06bef;hb=7f0e3bbf77382d9782e0189bf80f5f59a95779b3;hpb=f0eb394501ec21b9fe67f36cbf5db788711d4236
http://git.clamav.net/gitweb?p=clamav-devel.git;a=blob_plain;f=ChangeLog;hb=clamav-0.96.1
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-1640.json
https://api.first.org/data/v1/epss?cve=CVE-2010-1640
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1640
http://secunia.com/advisories/39895
https://exchange.xforce.ibmcloud.com/vulnerabilities/58825
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2031
http://www.mandriva.com/security/advisories?name=MDVSA-2010:110
http://www.openwall.com/lists/oss-security/2010/05/21/7
http://www.securityfocus.com/bid/40318
http://www.vupen.com/english/advisories/2010/1214
584183 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584183
597358 https://bugzilla.redhat.com/show_bug.cgi?id=597358
cpe:2.3:a:clamav:clamav:0.96:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.96:*:*:*:*:*:*:*
CVE-2010-1640 https://nvd.nist.gov/vuln/detail/CVE-2010-1640
GLSA-201009-06 https://security.gentoo.org/glsa/201009-06
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2010-1640
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.8209
EPSS Score 0.02005
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.