Search for vulnerabilities
Vulnerability details: VCID-k6y9-gydd-zfhq
Vulnerability ID VCID-k6y9-gydd-zfhq
Aliases CVE-2017-12379
Summary ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a messageAddArgument (in message.c) buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
System Score Found at
ssvc Track http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
epss 0.22232 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.22232 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.22232 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.22232 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.22232 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.22232 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.23095 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
ssvc Track https://bugzilla.clamav.net/show_bug.cgi?id=11944
cvssv3 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
ssvc Track https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
cvssv2 10.0 https://nvd.nist.gov/vuln/detail/CVE-2017-12379
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2017-12379
archlinux Critical https://security.archlinux.org/AVG-601
ssvc Track https://usn.ubuntu.com/3550-1/
ssvc Track https://usn.ubuntu.com/3550-2/
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2017-12379
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12379
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
888484 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888484
ASA-201802-1 https://security.archlinux.org/ASA-201802-1
AVG-601 https://security.archlinux.org/AVG-601
clamav-0993-has-been-released.html http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
CVE-2017-12379 https://nvd.nist.gov/vuln/detail/CVE-2017-12379
msg00035.html https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
show_bug.cgi?id=11944 https://bugzilla.clamav.net/show_bug.cgi?id=11944
USN-3550-1 https://usn.ubuntu.com/3550-1/
USN-3550-2 https://usn.ubuntu.com/3550-2/
No exploits are available.
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://bugzilla.clamav.net/show_bug.cgi?id=11944
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12379
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12379
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://usn.ubuntu.com/3550-1/
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://usn.ubuntu.com/3550-2/
Exploit Prediction Scoring System (EPSS)
Percentile 0.95555
EPSS Score 0.22232
Published At Aug. 12, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:35:29.188819+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.15/community.json 37.0.0