PT-2018-8667 · Cisco+3 · Clamav+3
Published
2018-03-04
·
Updated
2026-02-06
·
CVE-2018-0202
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
ClamAV versions prior to 0.99.4
Description:
The issue is caused by improper input validation when handling Portable Document Format (.pdf) files, allowing an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This can be achieved by sending a crafted .pdf file, which could cause an out-of-bounds read when scanned, resulting in a DoS condition. The vulnerability concerns the
pdf parse array and pdf parse string functions in libclamav/pdfng.c.Recommendations:
For ClamAV versions prior to 0.99.4, update to version 0.99.4 or later to resolve the issue. As a temporary workaround, consider restricting the scanning of .pdf files until the update is applied.
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Clamav
Suse
Ubuntu