Clam Anti-Virus Clamav vulnerabilities

CVE-2007-3123 [MEDIUM] CVE-2007-3123: unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to caus unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value, which triggers a heap-based buffer overflow.

CVE-2007-1745 [HIGH] CVE-2007-1745: The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897. NOTE: some of these details are obtained from third party information.

CVE-2006-2427 [HIGH] CVE-2006-2427: freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privi freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file.

CVE-2004-1876 [MEDIUM] CVE-2004-1876: The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows loc The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.

CVE-2005-2919 [MEDIUM] CWE-17 CVE-2005-2919: libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FSG packed executable.

CVE-2006-6481 [MEDIUM] CVE-2006-6481: Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

CVE-2008-1387 [MEDIUM] CVE-2008-1387: ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a craf ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

CVE-2007-3025 [MEDIUM] CVE-2007-3025: Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, when running on Solaris, allows remote attackers to cause a denial of service (hang) via unknown vectors related to the isURL function and regular expressions.

CVE-2005-3500 [MEDIUM] CVE-2005-3500: The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attac The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.

CVE-2008-1389 [MEDIUM] CWE-399 CVE-2008-1389: libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a den libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."

CVE-2006-5874 [MEDIUM] CVE-2006-5874: Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.

CVE-2008-1836 [MEDIUM] CVE-2008-1836: The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to caus The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated, which triggers a buffer over-read.

CVE-2005-0133 [MEDIUM] CVE-2005-0133: ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) vi ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers.

CVE-2007-4510 [MEDIUM] CVE-2007-4510: ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers to cause a denial of service (application crash) via (1) a crafted RTF file, which triggers a NULL dereference in the cli_scanrtf function in libclamav/rtf.c; or (2) a crafted HTML document with a data: URI, which triggers a NULL dereference in the c

CVE-2005-1922 [MEDIUM] CVE-2005-1922: The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor and memory consumption) via a crafted file that causes repeated errors in the cli_msexpand function.

CVE-2005-1923 [LOW] CVE-2005-1923: The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a cabinet (CAB) file with the cffile_FolderOffset field set to 0xff, which causes a zero-length read.

CVE-2004-1909 [LOW] CVE-2004-1909: Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (cra Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives, such as those generated by the Beagle/Bagle worm.

CVE-2007-6595 [LOW] CWE-59 CVE-2007-6595: ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary fi ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.

CVE-2005-2056 [LOW] CVE-2005-2056: The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to cause a denial of service (application crash) via a crafted Quantum archive.

CVE-2007-3024 [LOW] CVE-2007-3024: libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for tem libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.