Stack-based buffer overflow in the cliurlcanon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL.
Multiple unspecified vulnerabilities in ClamAV before 0.94 have unknown impact and attack vectors related to file descriptor leaks on the "error path" in (1) libclamav/others.c and (2) libclamav/sis.c.
Double free vulnerability in the vbareadprojectstrings function in vbaextract.c in libclamav in ClamAV before 0.97 might allow remote attackers to execute arbitrary code via crafted Visual Basic for Applications (VBA) data in a Microsoft Office document. NOTE: some of these details are obtained from third party information.
Integer underflow in the cliscanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.
Heap-based buffer overflow in the cliscanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.
The CLIISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.
An off-by-one error was found in the way the hash manager of Clam AntiVirus, a GPL anti-virus toolkit for UNIX, performed scan of messages with certain hashes. A remote attacker could provide a message with specially-crafted hash signature in it, leading to denial of service (clamscan executable crash).
Upstream bug report: [1] https://wwws.clamav.net/bugzilla/showbug.cgi?id=2818
Relevant patch: [2] http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=4842733eb3f09be61caeed83778bb6679141dbc5
Other references: [3] https://bugzilla.novell.com/showbug.cgi?id=708263 [4] http://git.clamav.net/gitweb?p=clamav-devel.git;a=blobplain;f=ChangeLog;hb=clamav-0.97.2 [5] http://www.clamav.net/lang/en/
The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.
A denial of service flaw was found in the way the bytecode engine of the Clam Antivirus scanner handled recursion level when scanning an unpacked file. If a local user was tricked into scanning a file or directory with 'load bytecode from the database' feature enabled, it could lead to clamscan executable crash.
References: [1] https://bugs.gentoo.org/showbug.cgi?id=387521 [2] http://www.openwall.com/lists/oss-security/2011/10/18/1 [3] http://git.clamav.net/gitweb?p=clamav-devel.git;a=blobplain;f=ChangeLog;hb=clamav-0.97.3
Upstream patch: [4] http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=3d664817f6ef833a17414a4ecea42004c35cc42f