PT-2018-9264 · Cisco+3 · Clamav+3

Hanno Böck · Publicado 2018-02-27 · Atualizado 2026-02-06 · CVE-2018-1000085

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: ClamAV version 0.99.3

Description: The issue is related to an out of bounds heap memory read in the XAR parser, specifically in the xar hash check() function. This can lead to memory leaking, potentially aiding in the development of exploit chains. The attack is exploitable if the victim scans a crafted XAR file.

Recommendations: For ClamAV version 0.99.3, consider updating to a version that includes the fix committed after d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6 to resolve the issue. As a temporary workaround, avoid scanning potentially crafted XAR files to minimize the risk of exploitation.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2018-1363

CLEANSTART-2026-LA13761

CLEANSTART-2026-NJ87139

CLEANSTART-2026-TC95380

CLEANSTART-2026-WX01708

CVE-2018-1000085

DLA-1307-1

MGASA-2018-0169

OPENSUSE-SU-2018_0825-1

OPENSUSE-SU-2018_2406-1

OPENSUSE-SU-2024:10685-1

SUSE-SU-2018:0809-1

SUSE-SU-2018:0863-1

SUSE-SU-2018:2323-1

SUSE-SU-2018:2323-2

USN-3592-1

USN-3592-2

Produtos afetados

Alt Linux

Clamav

Suse

Ubuntu

Referências · 178

• https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6 · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WX01708.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LA13761.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NJ87139 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TC95380.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TC95380 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LA13761 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NJ87139.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11423 · Nota de Segurança
• https://suse.com/security/cve/CVE-2020-3350 · Nota
• https://osv.dev/vulnerability/CVE-2023-20197 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-48579 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-12376 · Nota de Segurança
• https://suse.com/support/update/announcement/2018/suse-su-20182323-1 · Nota
• https://suse.com/security/cve/CVE-2005-3239 · Nota