Search for vulnerabilities
Vulnerability details: VCID-stpc-fnkp-aaaj
Vulnerability ID VCID-stpc-fnkp-aaaj
Aliases CVE-2017-12379
Summary ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a messageAddArgument (in message.c) buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
System Score Found at
generic_textual Medium http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
ssvc Track http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12379.html
epss 0.01142 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.01142 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.01142 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.01142 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.02463 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.15968 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
epss 0.22546 https://api.first.org/data/v1/epss?cve=CVE-2017-12379
ssvc Track https://bugzilla.clamav.net/show_bug.cgi?id=11944
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12379
cvssv3 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
ssvc Track https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
cvssv2 10.0 https://nvd.nist.gov/vuln/detail/CVE-2017-12379
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2017-12379
archlinux Critical https://security.archlinux.org/AVG-601
generic_textual Medium https://ubuntu.com/security/notices/USN-3550-1
generic_textual Medium https://ubuntu.com/security/notices/USN-3550-2
ssvc Track https://usn.ubuntu.com/3550-1/
ssvc Track https://usn.ubuntu.com/3550-2/
Reference id Reference type URL
http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12379.html
https://api.first.org/data/v1/epss?cve=CVE-2017-12379
https://bugzilla.clamav.net/show_bug.cgi?id=11944
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12379
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
https://ubuntu.com/security/notices/USN-3550-1
https://ubuntu.com/security/notices/USN-3550-2
https://usn.ubuntu.com/3550-1/
https://usn.ubuntu.com/3550-2/
888484 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888484
ASA-201802-1 https://security.archlinux.org/ASA-201802-1
AVG-601 https://security.archlinux.org/AVG-601
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
CVE-2017-12379 https://nvd.nist.gov/vuln/detail/CVE-2017-12379
GLSA-201801-19 https://security.gentoo.org/glsa/201801-19
No exploits are available.
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://bugzilla.clamav.net/show_bug.cgi?id=11944
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12379
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12379
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://usn.ubuntu.com/3550-1/
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-02T19:24:16Z/ Found at https://usn.ubuntu.com/3550-2/
Exploit Prediction Scoring System (EPSS)
Percentile 0.84524
EPSS Score 0.01142
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.