Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2008-0318: ClamAV <0.92.1 can be crashed or hijacked
CVE-2008-0318 · published 18 years ago
Summary
The ClamAV antivirus package used on Debian systems can be tricked by a specially crafted Windows executable file sent to the clamd scanner. This can make the scanner stop working and, in some cases, allow an attacker to run their own code on the server. Upgrade ClamAV to version 0.92.1 or later to eliminate the risk.
What to do
- Update debian clamav to version 0.92.1~dfsg-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | clamav |
< 0.92.1~dfsg-1 Fix: upgrade to 0.92.1~dfsg-1
|
| Debian:13 | debian | clamav |
< 0.92.1~dfsg-1 Fix: upgrade to 0.92.1~dfsg-1
|
| Debian:14 | debian | clamav |
< 0.92.1~dfsg-1 Fix: upgrade to 0.92.1~dfsg-1
|
| – | clam_anti-virus | clamav |
<= 0.92 cpe:2.3:a:clam_anti-virus:clamav:*:*:*:*:*:*:*:* |
Original advisory text
Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a cr...
Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file, which triggers a heap-based buffer overflow.
References
- https://security-tracker.debian.org/tracker/CVE-2008-0318 Vendor Advisory
- http://bugs.gentoo.org/show_bug.cgi?id=209915
- http://docs.info.apple.com/article.html?artnum=307562
- http://kolab.org/security/kolab-vendor-notice-19.txt
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658
- http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html
- http://secunia.com/advisories/28907 Vendor Advisory
- http://secunia.com/advisories/28913 Vendor Advisory
- http://secunia.com/advisories/28949 Vendor Advisory
- http://secunia.com/advisories/29001 Vendor Advisory
- http://secunia.com/advisories/29026 Vendor Advisory
- http://secunia.com/advisories/29048 Vendor Advisory
- http://secunia.com/advisories/29060 Vendor Advisory
- http://secunia.com/advisories/29420 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200802-09.xml
- http://securitytracker.com/id?1019394
- http://sourceforge.net/project/shownotes.php?release_id=575703 Patch
- http://support.novell.com/techcenter/psdb/512985d2cd3090bfb93dcb7b551179cf.html
- http://www.debian.org/security/2008/dsa-1497
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:088
- http://www.securityfocus.com/bid/27751
- http://www.vupen.com/english/advisories/2008/0503 Vendor Advisory
- http://www.vupen.com/english/advisories/2008/0606 Vendor Advisory
- http://www.vupen.com/english/advisories/2008/0924/references Vendor Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00462.h...
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00481.h...
Severity
10.0
Critical
Type
CWE-189Numeric Errors
Timeline
Published12 Feb 2008
Updated15 Oct 2026
First seen20 Sep 2026
Track software like this
Free during beta