Debian Clamav vulnerabilities

CVE-2007-4560 [HIGH] CVE-2007-4560: clamav - clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remot... clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail." Scope: local bookworm: resolved (fixed in 0.91.2-1~volatile1) bullseye: resolved (fixed in 0.91.2-1~volatile1) forky: resolved (fixed in 0.9

CVE-2023-20032 [CRITICAL] CVE-2023-20032: clamav - On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was ... On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may

CVE-2007-6335 [HIGH] CVE-2007-6335: clamav - Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to e... Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow. Scope: local bookworm: resolved (fixed in 0.92~dfsg-1~volatile2) bullseye: resolved (fixed in 0.92~dfsg-1~volatile2) forky: resolved (fixed in 0.92~dfsg-1~volatile2) sid: resolved (fixed in

CVE-2006-4182 [HIGH] CVE-2006-4182: clamav - Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, ... Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected. Scope: local bookworm: resolved (fixed in 0.88.5-1) bu

CVE-2006-4018 [HIGH] CVE-2006-4018: clamav - Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam ... Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values. Scope: local bookworm: resolved (fixed in 0.88.4-1) bullseye: resolved (fixed in 0.88.4-1) forky: resolved (fixed in 0.88.4-1)

CVE-2017-12379 [CRITICAL] CVE-2017-12379: clamav - ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that... ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. A

CVE-2017-12377 [CRITICAL] CVE-2017-12377: clamav - ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that... ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A succes

CVE-2024-20328 [MEDIUM] CVE-2024-20328: clamav - A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker... A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using

CVE-2025-20260 [CRITICAL] CVE-2025-20260: clamav - A vulnerability in the PDF scanning processes of ClamAV could allow an unauthent... A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit

CVE-2024-20290 [HIGH] CVE-2024-20290: clamav - A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthen... A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a

CVE-2012-1459 [MEDIUM] CVE-2012-1459: clamav - The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir ... The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117

CVE-2012-1457 [MEDIUM] CVE-2012-1457: clamav - The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, ava... The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 C

CVE-2019-12900 [CRITICAL] CVE-2019-12900: bzip2 - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write... BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. Scope: local bookworm: resolved (fixed in 1.0.6-9.1) bullseye: resolved (fixed in 1.0.6-9.1) forky: resolved (fixed in 1.0.6-9.1) sid: resolved (fixed in 1.0.6-9.1) trixie: resolved (fixed in 1.0.6-9.1)

CVE-2010-0098 [CRITICAL] CVE-2010-0098: clamav - ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats,... ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities. Scope: local bookworm: resolved (fixed in 0.96+dfsg-1) bullseye: resolved (fixed in 0.96+dfsg-1) forky: resolved (fixed in 0.96+dfsg-1) sid: resolved (fixed

CVE-2013-7088 [CRITICAL] CVE-2013-7088: clamav - ClamAV before 0.97.7 has buffer overflow in the libclamav component ClamAV before 0.97.7 has buffer overflow in the libclamav component Scope: local bookworm: resolved (fixed in 0.97.7+dfsg-1) bullseye: resolved (fixed in 0.97.7+dfsg-1) forky: resolved (fixed in 0.97.7+dfsg-1) sid: resolved (fixed in 0.97.7+dfsg-1) trixie: resolved (fixed in 0.97.7+dfsg-1)

CVE-2017-12376 [HIGH] CVE-2017-12376: clamav - ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that... ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to

CVE-2022-20770 [HIGH] CVE-2022-20770: clamav - On April 20, 2022, the following vulnerability in the ClamAV scanning library ve... On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service conditio

CVE-2022-20785 [HIGH] CVE-2022-20785: clamav - On April 20, 2022, the following vulnerability in the ClamAV scanning library ve... On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service conditi

CVE-2006-1615 [CRITICAL] CVE-2006-1615: clamav - Multiple format string vulnerabilities in the logging code in Clam AntiVirus (Cl... Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly. Scope: local bookworm: resolved (fixed in 0.88.1-1) bullse

CVE-2017-12375 [HIGH] CVE-2017-12375: clamav - The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability ... The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions (the rfc2047 function in mbox.c). An unauthenticated, r