Use-after-free error in ClamAV - CVE-2017-12374
Published: January 26, 2018 / Updated: January 29, 2018
Vulnerability identifier: #VU10312
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12374
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to input validation checking mechanisms during parsing mbox.c operations on bounce messages. A remote attacker can send a specially crafted input, trigger use-after-free error and cause the service to crash.
The weakness exists due to input validation checking mechanisms during parsing mbox.c operations on bounce messages. A remote attacker can send a specially crafted input, trigger use-after-free error and cause the service to crash.
Affected software
ClamAV
Gentoo Linux
Arch Linux
Amazon Linux AMI
Fedora
SUSE Linux
Ubuntu
Opensuse
clamav (Alpine package)
clamav
Gentoo Linux
Arch Linux
Amazon Linux AMI
Fedora
SUSE Linux
Ubuntu
Opensuse
clamav (Alpine package)
clamav
How to mitigate CVE-2017-12374
Update to version 0.99.3.
clamav (Alpine package) - update to 0.99.4-r0
clamav - addressed in versions 0.99.3-1.el7, 0.99.3-1.fc26, 0.99.3-1.fc27, 0.99.3-8.el6
clamav - addressed in versions 0.99.3-1.el7, 0.99.3-1.fc26, 0.99.3-1.fc27, 0.99.3-8.el6
External References
Related Security Bulletins
- Multiple vulnerabilities in ClamAV AntiVirus
- Gentoo update for ClamAV
- Ubuntu update for ClamAV
- Ubuntu update for ClamAV
- Arch Linux update for clamav
- Arch Linux update for clamav
- Amazon Linux AMI update for clamav
- SUSE Linux update for clamav
- SUSE Linux update for clamav
- OpenSUSE Linux update for clamav
- Use-after-free error in clamav (Alpine package)
- Fedora 27 update for clamav
- Fedora 26 update for clamav
- Fedora EPEL 7 update for clamav
- Fedora EPEL 6 update for clamav