Where
-Infinity
0
Severity
2.1
AV:L/AC:L/Au:N/C:N/I:P/A:N

ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cligentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.

First published (updated )
Severity
5
Input Validation
AV:N/AC:L/Au:N/C:P/I:N/A:N

ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file.

First published (updated )
Severity
10
AV:N/AC:L/Au:N/C:C/I:C/A:C

Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlibprivate.h in ClamAV before 0.92 has unknown impact and remote attack vectors.

First published (updated )
Severity
6.8
Buffer Overflow
AV:N/AC:M/Au:N/C:P/I:P/A:P

Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.

First published (updated )
Severity
7.5
Buffer Overflow, Integer Overflow
AV:N/AC:L/Au:N/C:P/I:P/A:P

Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow.

First published (updated )
Severity
7.5
Code Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

Unspecified vulnerability in ClamAV 0.91.1 and 0.91.2 allows remote attackers to execute arbitrary code via a crafted e-mail message. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.

First published (updated )
Severity
7.6
OS Command Injection
AV:N/AC:H/Au:N/C:C/I:C/A:C

clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."

First published (updated )
Severity
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers to cause a denial of service (application crash) via (1) a crafted RTF file, which triggers a NULL dereference in the cliscanrtf function in libclamav/rtf.c; or (2) a crafted HTML document with a data: URI, which triggers a NULL dereference in the clihtmlnormalise function in libclamav/htmlnorm.c. NOTE: some of these details are obtained from third party information.

First published (updated )
Severity
4.3
Null Pointer Dereference
AV:N/AC:M/Au:N/C:N/I:N/A:P

The RAR VM (unrarvm.c) in Clam Antivirus (ClamAV) before 0.91 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive, resulting in a NULL pointer dereference.

First published (updated )
Severity
2.1
AV:L/AC:L/Au:N/C:P/I:N/A:N

libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cligentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.

First published (updated )
Severity
5
Buffer Overflow
AV:N/AC:L/Au:N/C:N/I:N/A:P

unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vmcodesize value, which triggers a heap-based buffer overflow.

First published (updated )
Severity
5
AV:N/AC:L/Au:N/C:N/I:P/A:N

The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning via a RAR file with a header flag value of 10, which can be processed by WinRAR.

First published (updated )
Severity
10
AV:N/AC:L/Au:N/C:C/I:C/A:C

unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors.

First published (updated )
Severity
7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C

File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF file.

First published (updated )
Severity
7.5
Buffer Overflow
AV:N/AC:L/Au:N/C:P/I:P/A:P

Integer signedness error in the (1) cabunstore and (2) cabextract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow.

First published (updated )
Severity
7.1
AV:N/AC:M/Au:N/C:N/I:N/A:C

The chmdecompressstream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897. NOTE: some of these details are obtained from third party information.

First published (updated )
Severity
6.4
Path Traversal
AV:N/AC:L/Au:N/C:N/I:P/A:P

Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message.

First published (updated )
Severity
7.5
AV:N/AC:M/Au:N/C:N/I:N/A:P

Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.

First published (updated )
Severity
5
AV:N/AC:L/Au:N/C:N/I:N/A:P

Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

First published (updated )
Severity
5
AV:N/AC:L/Au:N/C:N/I:P/A:N

Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

First published (updated )
Severity
5
Null Pointer Dereference
AV:N/AC:L/Au:N/C:N/I:N/A:P

Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.

First published (updated )
Severity
5
AV:N/AC:L/Au:N/C:N/I:N/A:P

Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a crafted Compressed HTML Help (CHM) file that causes ClamAV to "read an invalid memory location."

First published (updated )
Severity
7.5
Buffer Overflow, Integer Overflow
AV:N/AC:L/Au:N/C:P/I:P/A:P

Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.

First published (updated )
Severity
7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C

freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file.

First published (updated )
Severity
5.1
Buffer Overflow
AV:N/AC:H/Au:N/C:P/I:P/A:P

Buffer overflow in the getdatabase function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.

First published (updated )
Severity
5
AV:N/AC:L/Au:N/C:N/I:N/A:P

The clibitsetset function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an "invalid memory access."

First published (updated )
Severity
5.1
Integer Overflow
AV:N/AC:H/Au:N/C:P/I:P/A:P

Integer overflow in the cliscanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code.

First published (updated )
Severity
7.5
Buffer Overflow
AV:N/AC:L/Au:N/C:P/I:P/A:P

Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.

First published (updated )
Severity
10
AV:N/AC:L/Au:N/C:C/I:C/A:C

Improper boundary checks in petite.c in Clam AntiVirus (ClamAV) before 0.87.1 allows attackers to perform unknown attacks via unknown vectors.

First published (updated )
Severity
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause "memory corruption" and execute arbitrary code via a crafted FSG 1.33 file.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203