PT-2018-5393 · Cisco+3 · Clamav+3
Publicado
2018-01-26
·
Atualizado
2026-02-06
·
CVE-2017-12376
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
ClamAV AntiVirus software versions 0.99.2 and prior
Description:
The issue is caused by improper input validation when handling Portable Document Format (.pdf) files, which could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. This can be achieved by sending a crafted .pdf file to an affected device, causing a buffer overflow in the
handle pdfname function (in pdf.c) when ClamAV scans the malicious file.Recommendations:
For ClamAV AntiVirus software versions 0.99.2 and prior, update to a version later than 0.99.2 to resolve the issue. As a temporary workaround, consider restricting the handling of .pdf files by ClamAV to minimize the risk of exploitation.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Clamav
Suse
Ubuntu