PT-2017-3503 · Cisco+3 · Clamav+3
Published
2017-10-26
·
Updated
2026-02-06
·
CVE-2017-12379
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
ClamAV AntiVirus software versions 0.99.2 and prior
Description
The issue is due to improper input validation checking mechanisms in the message parsing function, specifically the
messageAddArgument function in message.c, which can lead to a buffer overflow condition. An unauthenticated, remote attacker could exploit this by sending a crafted email to the affected device, potentially causing a denial of service condition or executing arbitrary code.Recommendations
For ClamAV AntiVirus software versions 0.99.2 and prior, consider updating to a version that addresses the improper input validation in the message parsing function to prevent potential exploitation. As a temporary workaround, consider restricting the handling of emails by ClamAV to minimize the risk of exploitation until a patch is available.
Exploit
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Clamav
Suse
Ubuntu