The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.
Multiple unspecified vulnerabilities in ClamAV before 0.94 have unknown impact and attack vectors related to file descriptor leaks on the "error path" in (1) libclamav/others.c and (2) libclamav/sis.c.
Stack-based buffer overflow in the cliurlcanon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL.
The CLIISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.
A denial of service flaw was found in the way the bytecode engine of the Clam Antivirus scanner handled recursion level when scanning an unpacked file. If a local user was tricked into scanning a file or directory with 'load bytecode from the database' feature enabled, it could lead to clamscan executable crash.
References: [1] https://bugs.gentoo.org/showbug.cgi?id=387521 [2] http://www.openwall.com/lists/oss-security/2011/10/18/1 [3] http://git.clamav.net/gitweb?p=clamav-devel.git;a=blobplain;f=ChangeLog;hb=clamav-0.97.3
Upstream patch: [4] http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=3d664817f6ef833a17414a4ecea42004c35cc42f
An off-by-one error was found in the way the hash manager of Clam AntiVirus, a GPL anti-virus toolkit for UNIX, performed scan of messages with certain hashes. A remote attacker could provide a message with specially-crafted hash signature in it, leading to denial of service (clamscan executable crash).
Upstream bug report: [1] https://wwws.clamav.net/bugzilla/showbug.cgi?id=2818
Relevant patch: [2] http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=4842733eb3f09be61caeed83778bb6679141dbc5
Other references: [3] https://bugzilla.novell.com/showbug.cgi?id=708263 [4] http://git.clamav.net/gitweb?p=clamav-devel.git;a=blobplain;f=ChangeLog;hb=clamav-0.97.2 [5] http://www.clamav.net/lang/en/
Double free vulnerability in the vbareadprojectstrings function in vbaextract.c in libclamav in ClamAV before 0.97 might allow remote attackers to execute arbitrary code via crafted Visual Basic for Applications (VBA) data in a Microsoft Office document. NOTE: some of these details are obtained from third party information.
Integer underflow in the cliscanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.
Heap-based buffer overflow in the cliscanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.