CVE-2017-12378
Summary
| CVE | CVE-2017-12378 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-01-26 20:29:00 UTC |
|---|
| Updated | 2019-10-03 00:03:00 UTC |
|---|
| Description | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Bug 11946 – Heap overflow in getchecksum(untar.c) |
CONFIRM |
bugzilla.clamav.net |
Exploit, Issue Tracking, Patch, Vendor Advisory |
| [SECURITY] [DLA 1261-1] clamav security update |
MLIST |
lists.debian.org |
Mailing List, Third Party Advisory |
| ClamAV® blog: ClamAV 0.99.3 has been released! |
CONFIRM |
blog.clamav.net |
Release Notes, Vendor Advisory |
| USN-3550-1: ClamAV vulnerabilities | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
|
| USN-3550-2: ClamAV vulnerabilities | Ubuntu security notices |
UBUNTU |
usn.ubuntu.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500102 Alpine Linux Security Update for clamav
- 503826 Alpine Linux Security Update for clamav
- 710255 Gentoo Linux ClamAV Multiple Vulnerabilities (GLSA 201801-19)
