ClamAV Multiple Denial of Service Vulnerabilities

Bugtraq ID:	74443
Class:	Input Validation Error
CVE:	CVE-2015-2170 CVE-2015-2221 CVE-2015-2222
Remote:	Yes
Local:	No
Published:	May 03 2015 12:00AM
Updated:	Jan 14 2016 11:52PM
Credit:	Sebastian Andrzej Siewior
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Gentoo Linux Clam Anti-Virus ClamAV 0.96.5 Clam Anti-Virus ClamAV 0.96.4 Clam Anti-Virus ClamAV 0.96.3 Clam Anti-Virus ClamAV 0.96.2 Clam Anti-Virus ClamAV 0.96.1 Clam Anti-Virus ClamAV 0.95.2 Clam Anti-Virus ClamAV 0.95.1 Clam Anti-Virus ClamAV 0.94.2 Clam Anti-Virus ClamAV 0.94.1 Clam Anti-Virus ClamAV 0.93.3 Clam Anti-Virus ClamAV 0.93.1 Clam Anti-Virus ClamAV 0.92.1 Clam Anti-Virus ClamAV 0.91.2 Clam Anti-Virus ClamAV 0.91.1 Clam Anti-Virus ClamAV 0.90.3 Clam Anti-Virus ClamAV 0.90.2 Clam Anti-Virus ClamAV 0.90.1 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel + Debian Linux 4.0 mips + Debian Linux 4.0 m68k + Debian Linux 4.0 ia-64 + Debian Linux 4.0 ia-32 + Debian Linux 4.0 hppa + Debian Linux 4.0 arm + Debian Linux 4.0 amd64 + Debian Linux 4.0 alpha + Debian Linux 4.0 Clam Anti-Virus ClamAV 0.90 - MandrakeSoft Corporate Server 4.0 x86_64 - MandrakeSoft Corporate Server 3.0 x86_64 - MandrakeSoft Corporate Server 3.0 - MandrakeSoft Corporate Server 4.0 - Mandriva Linux Mandrake 2007.1 x86_64 - Mandriva Linux Mandrake 2007.1 - Mandriva Linux Mandrake 2007.0 x86_64 - Mandriva Linux Mandrake 2007.0 Clam Anti-Virus ClamAV 0.88.5 Clam Anti-Virus ClamAV 0.88.4 Clam Anti-Virus ClamAV 0.88.3 Clam Anti-Virus ClamAV 0.88.2 Clam Anti-Virus ClamAV 0.88.1 Clam Anti-Virus ClamAV 0.87.1 Clam Anti-Virus ClamAV 0.87 -1 Clam Anti-Virus ClamAV 0.86.2 Clam Anti-Virus ClamAV 0.86 .1 Clam Anti-Virus ClamAV 0.85.1 Clam Anti-Virus ClamAV 0.81 + Gentoo Linux Clam Anti-Virus ClamAV 0.75.1 Clam Anti-Virus ClamAV 0.70 Clam Anti-Virus ClamAV 0.68 -1 Clam Anti-Virus ClamAV 0.68 Clam Anti-Virus ClamAV 0.67 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.4 Clam Anti-Virus ClamAV 0.65 Clam Anti-Virus ClamAV 0.60 Clam Anti-Virus ClamAV 0.54 Clam Anti-Virus ClamAV 0.53 Clam Anti-Virus ClamAV 0.52 Clam Anti-Virus ClamAV 0.51 Clam Anti-Virus ClamAV 0.97.3 Clam Anti-Virus ClamAV 0.97.2 Clam Anti-Virus ClamAV 0.97 Clam Anti-Virus ClamAV 0.96 Clam Anti-Virus ClamAV 0.95 Clam Anti-Virus ClamAV 0.94 Clam Anti-Virus ClamAV 0.93 Clam Anti-Virus ClamAV 0.92 Clam Anti-Virus ClamAV 0.91 Clam Anti-Virus ClamAV 0.88.6
Not Vulnerable:

ClamAV Multiple Denial of Service Vulnerabilities

ClamAV is prone to multiple denial-of-service vulnerabilities.

Attackers can exploit these issues to crash the affected application, denying service to legitimate users.

Versions prior to ClamAV 0.98.7 are vulnerable.

ClamAV Multiple Denial of Service Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

ClamAV Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ClamAV Multiple Denial of Service Vulnerabilities

References:

• ClamAV Homepage (Clam Anti-Virus)