PT-2007-5686 · Cisco · Clamav
Stefanos Stamatis
·
Publicado
2007-08-23
·
Atualizado
2017-07-29
·
CVE-2007-4510
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
ClamAV versions prior to 0.91.2
Description
The issue allows remote attackers to cause a denial of service, resulting in an application crash. This can be achieved through a crafted RTF file, which triggers a NULL dereference in the
cli scanrtf function, or a crafted HTML document with a data: URI, triggering a NULL dereference in the cli html normalise function.Recommendations
For ClamAV versions prior to 0.91.2, update to version 0.91.2 or later to resolve the issue. As a temporary workaround, consider restricting the processing of RTF files and HTML documents with
data: URIs to minimize the risk of exploitation.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Clamav