CVE-2014-9050: Buffer Overflow
Published Dec 1, 2014
·Updated
Heap-based buffer overflow in the cliscanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.
Affected Software
99 affected components
clamav clamav<=0.94.3
clamav clamav=0.01
clamav clamav=0.02
clamav clamav=0.3
clamav clamav=0.03
clamav clamav=0.05
clamav clamav=0.8-rc3
clamav clamav=0.9-rc1
clamav clamav=0.10
clamav clamav=0.12
clamav clamav=0.13
clamav clamav=0.14
clamav clamav=0.14-pre
clamav clamav=0.15
clamav clamav=0.20
clamav clamav=0.21
clamav clamav=0.22
clamav clamav=0.23
clamav clamav=0.24
clamav clamav=0.51
clamav clamav=0.52
clamav clamav=0.53
clamav clamav=0.54
clamav clamav=0.60
clamav clamav=0.60p
clamav clamav=0.65
clamav clamav=0.66
clamav clamav=0.67
clamav clamav=0.67-1
clamav clamav=0.68
clamav clamav=0.68.1
clamav clamav=0.70
clamav clamav=0.70-rc
clamav clamav=0.71
clamav clamav=0.72
clamav clamav=0.73
clamav clamav=0.74
clamav clamav=0.75
clamav clamav=0.75.1
clamav clamav=0.80
clamav clamav=0.80-rc
clamav clamav=0.80-rc1
clamav clamav=0.80-rc2
clamav clamav=0.80-rc3
clamav clamav=0.80-rc4
clamav clamav=0.80_rc
clamav clamav=0.81
clamav clamav=0.81-rc1
clamav clamav=0.82
clamav clamav=0.83
clamav clamav=0.84
clamav clamav=0.84-rc1
clamav clamav=0.84-rc2
clamav clamav=0.85
clamav clamav=0.85.1
clamav clamav=0.86
clamav clamav=0.86-rc1
clamav clamav=0.86.1
clamav clamav=0.86.2
clamav clamav=0.87
clamav clamav=0.87.1
clamav clamav=0.88
clamav clamav=0.88.1
clamav clamav=0.88.2
clamav clamav=0.88.3
clamav clamav=0.88.4
clamav clamav=0.88.5
clamav clamav=0.88.6
clamav clamav=0.88.7
clamav clamav=0.88.7_p0
clamav clamav=0.88.7_p1
clamav clamav=0.90
clamav clamav=0.90-rc1
clamav clamav=0.90-rc1.1
clamav clamav=0.90-rc2
clamav clamav=0.90-rc3
clamav clamav=0.90.1
clamav clamav=0.90.1_p0
clamav clamav=0.90.2
clamav clamav=0.90.2_p0
clamav clamav=0.90.3
clamav clamav=0.90.3_p0
clamav clamav=0.90.3_p1
clamav clamav=0.91
clamav clamav=0.91-rc1
clamav clamav=0.91-rc2
clamav clamav=0.91.1
clamav clamav=0.91.2
clamav clamav=0.91.2_p0
clamav clamav=0.92
clamav clamav=0.92.1
clamav clamav=0.92_p0
clamav clamav=0.93
clamav clamav=0.93.1
clamav clamav=0.93.2
clamav clamav=0.93.3
clamav clamav=0.94
clamav clamav=0.94.1
clamav clamav=0.94.2
Remediation
Patch Available
Event History
Dec 1, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9050?
CVE-2014-9050 has a severity rating that may allow remote attackers to cause a denial of service due to a heap-based buffer overflow.
2
How do I fix CVE-2014-9050?
To mitigate CVE-2014-9050, update to ClamAV version 0.98.5 or later.
3
What versions of ClamAV are affected by CVE-2014-9050?
CVE-2014-9050 affects ClamAV versions prior to 0.98.5.
4
What happens if I do not fix CVE-2014-9050?
Failing to address CVE-2014-9050 could result in crashes and denial of service attacks from specially crafted PE files.
5
What is the nature of the vulnerability in CVE-2014-9050?
The vulnerability in CVE-2014-9050 is a heap-based buffer overflow specifically in the cli_scanpe function.