Out-of-bounds read in ClamAV - CVE-2017-6418

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU12171

Out-of-bounds read in ClamAV - CVE-2017-6418

Published: April 25, 2018


Vulnerability identifier: #VU12171
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6418
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a rmeote attacker to cause DoS condition on the target system.

The weakness exists in libclamav/message.c due to out-of-bounds read. A remote attacker can trick the victim into opening a specially crafted e-mail message, trigger memory corruption and cause the service to crash.

Affected software

ClamAV
Arch Linux
Gentoo Linux
Amazon Linux AMI
Fedora
SUSE Linux
Ubuntu
Opensuse
clamav

How to mitigate CVE-2017-6418

Update to version 0.99.3.

clamav - addressed in versions 0.99.2-17.el7, 0.99.2-17.fc26, 0.99.2-17.fc27, 0.99.2-18.el7, 0.99.2-18.fc26, 0.99.2-18.fc27, 0.99.3-1.el7, 0.99.3-1.fc26, 0.99.3-1.fc27, 0.99.3-8.el6

External References

Related Security Bulletins