CVE-2006-1989 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Anti-virus Clamav

5 documents5 sources
Severity
5.1MEDIUMNVD
EPSS
4.5%
top 10.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ClamavClam Anti-virus Clamav
Timeline
PublishedMay 1
Latest updateMay 1

Description

Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages2 packages

▶Debianclamav/clamav< 0.88.2+3
▶NVDclam_anti-virus/clamav0.88, 0.88.1+1

Patches

Patch: secunia.com ↗Patch: www.securityfocus.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-66xq-fpgf-chwg: Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0↗2022-05-01
▶
OSV
CVE-2006-1989: Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0↗2006-05-01
▶
CVEList
CVE-2006-1989: Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0↗2006-05-01
▶

📋Vendor Advisories

1
Debian
CVE-2006-1989: clamav - Buffer overflow in the get_database function in the HTTP client in Freshclam in ...↗2006
▶