CVE-2017-12374
Summary
| CVE | CVE-2017-12374 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-01-26 20:29:00 UTC |
|---|
| Updated | 2018-03-16 01:29:00 UTC |
|---|
| Description | The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] [DLA 1261-1] clamav security update |
MLIST |
lists.debian.org |
Mailing List, Third Party Advisory |
| ClamAV® blog: ClamAV 0.99.3 has been released! |
CONFIRM |
blog.clamav.net |
Release Notes, Vendor Advisory |
| USN-3550-1: ClamAV vulnerabilities | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
|
| USN-3550-2: ClamAV vulnerabilities | Ubuntu security notices |
UBUNTU |
usn.ubuntu.com |
|
| Bug 11939 – UAF in textIterate (mbox.c) |
CONFIRM |
bugzilla.clamav.net |
Exploit, Issue Tracking, Patch, Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500102 Alpine Linux Security Update for clamav
- 503826 Alpine Linux Security Update for clamav
- 710255 Gentoo Linux ClamAV Multiple Vulnerabilities (GLSA 201801-19)
