Buffer overflow in ClamAV - CVE-2017-12376

Vulnerability identifier: #VU10314

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12376

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists due to input validation checking mechanisms when handling Portable Document Format (.pdf) files. A remote attacker can send a specially crafted .pdf file, trigger handle_pdfname (in pdf.c) buffer overflow and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

ClamAV
Gentoo Linux
Arch Linux
Amazon Linux AMI
Fedora
SUSE Linux
Ubuntu
Opensuse
clamav (Alpine package)
clamav

Update to version 0.99.3.

clamav - addressed in versions 0.99.3-1.el7, 0.99.3-1.fc26, 0.99.3-1.fc27, 0.99.3-8.el6

• http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html

• Multiple vulnerabilities in ClamAV AntiVirus
• Gentoo update for ClamAV
• Ubuntu update for ClamAV
• Ubuntu update for ClamAV
• Arch Linux update for clamav
• Arch Linux update for clamav
• Amazon Linux AMI update for clamav
• SUSE Linux update for clamav
• SUSE Linux update for clamav
• OpenSUSE Linux update for clamav
• Buffer overflow in clamav (Alpine package)
• Fedora 27 update for clamav
• Fedora 26 update for clamav
• Fedora EPEL 7 update for clamav
• Fedora EPEL 6 update for clamav