CVE-2007-6336: Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.

PriorityP334medium6.8CVSS 2.0

AVNACMAuNCPIPAP

EPSS

4.21%

89.7th percentile

Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
clam_anti-virus	clamav	<= 0.91	—
clamav	clamav	>= 0 < 0.92~dfsg-1~volatile2	0.92~dfsg-1~volatile2
clamav	clamav	>= 0 < 0.92~dfsg-1~volatile2	0.92~dfsg-1~volatile2
clamav	clamav	>= 0 < 0.92~dfsg-1~volatile2	0.92~dfsg-1~volatile2
clamav	clamav	>= 0 < 0.92~dfsg-1~volatile2	0.92~dfsg-1~volatile2
debian	clamav	< clamav 0.92~dfsg-1~volatile2 (bookworm)	clamav 0.92~dfsg-1~volatile2 (bookworm)

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv6.8MEDIUM

vendor_debian6.8MEDIUM

vendor_redhat6.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.