Null pointer dereference in ClamAV - CVE-2017-12380

Vulnerability identifier: #VU10318

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12380

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to input validation checking mechanisms during parsing the rfc2047 function in mbox.c during certain mail parsing functions. A remote attacker can send a specially crafted email, trigger a NULL pointer dereference condition and cause the service to crash.

ClamAV
Gentoo Linux
Arch Linux
Amazon Linux AMI
Fedora
SUSE Linux
Ubuntu
Opensuse
clamav (Alpine package)
clamav

Update to version 0.99.3.

clamav (Alpine package) - update to 0.100.1-r0
clamav - addressed in versions 0.99.3-1.el7, 0.99.3-1.fc26, 0.99.3-1.fc27, 0.99.3-8.el6

• http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html

• Multiple vulnerabilities in ClamAV AntiVirus
• Gentoo update for ClamAV
• Ubuntu update for ClamAV
• Ubuntu update for ClamAV
• Arch Linux update for clamav
• Arch Linux update for clamav
• Amazon Linux AMI update for clamav
• SUSE Linux update for clamav
• SUSE Linux update for clamav
• OpenSUSE Linux update for clamav
• Null pointer dereference in clamav (Alpine package)
• Fedora 27 update for clamav
• Fedora 26 update for clamav
• Fedora EPEL 7 update for clamav
• Fedora EPEL 6 update for clamav