clam anti-virus vulnerabilities

Recent CVEs affecting clam anti-virus products. 60 tracked.

clam anti-virus has 60 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 16. Most recent: 2008-12-03. Highest priority: CVE-2008-5050 (score 61/100).

• CVE-2008-5314 MEDIUM 4.3 UPGRADE Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to caus
• CVE-2008-5050 HIGH 9.3 UPGRADE Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before
• CVE-2008-3215 MEDIUM 5.0 DOWNGRADE libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malforme
• CVE-2008-2713 MEDIUM 5.0 DOWNGRADE libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted
• CVE-2008-1837 MEDIUM 5.0 UPGRADE libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RA
• CVE-2008-1836 MEDIUM 4.3 DOWNGRADE The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial
• CVE-2008-1835 MEDIUM 5.0 UPGRADE ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid versio
• CVE-2008-1833 HIGH 7.5 DOWNGRADE Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary
• CVE-2008-1389 MEDIUM 5.0 UPGRADE libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of ser
• CVE-2008-1387 MEDIUM 4.3 DOWNGRADE ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ ar
• CVE-2008-1100 HIGH 10.0 DOWNGRADE Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows rem
• CVE-2008-0318 HIGH 10.0 UPGRADE Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows rem
• CVE-2008-0314 HIGH 7.5 DOWNGRADE Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrar
• CVE-2007-6596 MEDIUM 5.0 DOWNGRADE ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner
• CVE-2007-6595 LOW 2.1 DOWNGRADE ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used b
• CVE-2007-6337 HIGH 10.0 DOWNGRADE Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlib_private.h in ClamAV before 0.92 h
• CVE-2007-6336 MEDIUM 6.8 UPGRADE Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP
• CVE-2007-6335 HIGH 7.5 UPGRADE Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a cr
• CVE-2007-6029 HIGH 7.5 DOWNGRADE Unspecified vulnerability in ClamAV 0.91.1 and 0.91.2 allows remote attackers to execute arbitrary code via a
• CVE-2007-4560 HIGH 7.6 UPGRADE clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitra
• CVE-2007-4510 MEDIUM 4.3 UPGRADE DOWNGRADE ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers
• CVE-2007-3725 MEDIUM 4.3 DOWNGRADE The RAR VM (unrarvm.c) in Clam Antivirus (ClamAV) before 0.91 allows user-assisted remote attackers to cause a
• CVE-2007-3123 MEDIUM 5.0 DOWNGRADE unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial
• CVE-2007-3122 MEDIUM 5.0 DOWNGRADE The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning
• CVE-2007-3025 MEDIUM 5.0 DOWNGRADE Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, when runn
• CVE-2007-3024 LOW 2.1 DOWNGRADE libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary fil
• CVE-2007-3023 HIGH 10.0 DOWNGRADE unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer
• CVE-2007-2029 HIGH 7.8 DOWNGRADE File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial o
• CVE-2007-1997 HIGH 7.5 DOWNGRADE Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiV
• CVE-2007-1745 HIGH 7.1 UPGRADE DOWNGRADE The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks fil
• CVE-2007-0898 MEDIUM 6.4 UPGRADE Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to ove
• CVE-2006-6481 MEDIUM 5.0 DOWNGRADE Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and applic
• CVE-2006-6406 MEDIUM 5.0 DOWNGRADE Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characte
• CVE-2006-5874 MEDIUM 5.0 UPGRADE Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a ma
• CVE-2006-5295 MEDIUM 5.0 UPGRADE Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanni
• CVE-2006-4182 HIGH 7.5 UPGRADE Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cau
• CVE-2006-2427 HIGH 7.2 DOWNGRADE DOWNGRADE freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges befo
• CVE-2006-1989 MEDIUM 5.1 DOWNGRADE Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might al
• CVE-2006-1630 MEDIUM 5.0 DOWNGRADE The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attac
• CVE-2006-1614 MEDIUM 5.1 DOWNGRADE Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV
• CVE-2006-0162 HIGH 7.5 DOWNGRADE Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers t
• CVE-2005-3587 HIGH 10.0 DOWNGRADE Improper boundary checks in petite.c in Clam AntiVirus (ClamAV) before 0.87.1 allows attackers to perform unkn
• CVE-2005-3500 MEDIUM 5.0 DOWNGRADE The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to ca
• CVE-2005-3303 HIGH 7.5 DOWNGRADE The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause "memory
• CVE-2005-3239 HIGH 7.8 DOWNGRADE The OLE2 unpacker in clamd in Clam AntiVirus (ClamAV) 0.87-1 allows remote attackers to cause a denial of serv
• CVE-2005-2920 HIGH 7.5 DOWNGRADE Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute a
• CVE-2005-2919 MEDIUM 5.0 DOWNGRADE libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (i
• CVE-2005-2450 HIGH 7.5 DOWNGRADE Multiple integer overflows in the (1) TNEF, (2) CHM, or (3) FSG file format processors in libclamav for Clam A
• CVE-2005-2056 LOW 2.6 DOWNGRADE The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to cause a d
• CVE-2005-1923 LOW 2.6 DOWNGRADE The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows rem
• CVE-2005-1922 MEDIUM 5.0 DOWNGRADE The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial o
• CVE-2005-1800 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in Jaws Glossary gadget 0.4 to 0.5.1 allows remote attackers to injec
• CVE-2005-1795 HIGH 7.5 UPGRADE The filecopy function in misc.c in Clam AntiVirus (ClamAV) before 0.85, on Mac OS, allows remote attackers to
• CVE-2005-1711 HIGH 7.5 DOWNGRADE DOWNGRADE Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV meth
• CVE-2005-0218 MEDIUM 5.0 DOWNGRADE ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data:
• CVE-2005-0133 MEDIUM 5.0 DOWNGRADE ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP fi
• CVE-2004-1909 LOW 2.6 DOWNGRADE Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via ce
• CVE-2004-1876 MEDIUM 4.6 DOWNGRADE The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users t
• CVE-2004-0270 MEDIUM 5.0 DOWNGRADE libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded
• CVE-2003-0946 HIGH 7.5 DOWNGRADE Format string vulnerability in clamav-milter for Clam AntiVirus 0.60 through 0.60p, and other versions before

FAQ

How do I fix clam anti-virus vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is clam anti-virus being exploited right now?

None of the tracked clam anti-virus CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which clam anti-virus CVE should I patch first?

CVE-2008-5050 currently ranks highest (61/100): Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before.

Products

• clamav
• clamxav

RSS feed for clam anti-virus · ← Back to latest CVEs