Clam Anti-virus Clamav — known CVE vulnerabilities

Every CVE whose affected-product data names Clam Anti-virus Clamav, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (60)

• CVE-2007-3023 — CVSS 10.0 (critical): unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and…
• CVE-2007-6337 — CVSS 10.0 (critical): Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlib_private.h in ClamAV before 0.92 has unknown impact and remote…
• CVE-2005-3587 — CVSS 10.0 (critical): Improper boundary checks in petite.c in Clam AntiVirus (ClamAV) before 0.87.1 allows attackers to perform unknown attacks via unknown…
• CVE-2008-1100 — CVSS 10.0 (critical): Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute…
• CVE-2008-0318 — CVSS 10.0 (critical): Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows remote attackers to cause a…
• CVE-2008-5050 — CVSS 9.3 (critical): Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote…
• CVE-2005-3239 — CVSS 7.8 (high): The OLE2 unpacker in clamd in Clam AntiVirus (ClamAV) 0.87-1 allows remote attackers to cause a denial of service (segmentation fault) via…
• CVE-2007-2029 — CVSS 7.8 (high): File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF…
• CVE-2007-4560 — CVSS 7.6 (high): clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell…
• CVE-2005-3303 — CVSS 7.5 (high): The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause "memory corruption" and execute…
• CVE-2006-0162 — CVSS 7.5 (high): Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service…
• CVE-2007-1997 — CVSS 7.5 (high): Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2…
• CVE-2003-0946 — CVSS 7.5 (high): Format string vulnerability in clamav-milter for Clam AntiVirus 0.60 through 0.60p, and other versions before 0.65, allows remote attackers…
• CVE-2006-4182 — CVSS 7.5 (high): Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service…
• CVE-2008-1833 — CVSS 7.5 (high): Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack…
• CVE-2008-0314 — CVSS 7.5 (high): Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted PeSpin…
• CVE-2005-1711 — CVSS 7.5 (high): Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for…
• CVE-2005-1795 — CVSS 7.5 (high): The filecopy function in misc.c in Clam AntiVirus (ClamAV) before 0.85, on Mac OS, allows remote attackers to execute arbitrary code via a…
• CVE-2007-6335 — CVSS 7.5 (high): Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file…
• CVE-2007-6029 — CVSS 7.5 (high): Unspecified vulnerability in ClamAV 0.91.1 and 0.91.2 allows remote attackers to execute arbitrary code via a crafted e-mail message. NOTE…
• CVE-2005-2450 — CVSS 7.5 (high): Multiple integer overflows in the (1) TNEF, (2) CHM, or (3) FSG file format processors in libclamav for Clam AntiVirus (ClamAV) 0.86.1 and…
• CVE-2005-2920 — CVSS 7.5 (high): Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted…
• CVE-2006-2427 — CVSS 7.2 (high): freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file…
• CVE-2007-1745 — CVSS 7.1 (high): The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has…
• CVE-2007-6336 — CVSS 6.8 (medium): Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file.
• CVE-2007-0898 — CVSS 6.4 (medium): Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a…
• CVE-2006-1614 — CVSS 5.1 (medium): Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when…
• CVE-2006-1989 — CVSS 5.1 (medium): Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to…
• CVE-2006-6481 — CVSS 5.0 (medium): Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many…
• CVE-2006-1630 — CVSS 5.0 (medium): The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of…
• CVE-2005-3500 — CVSS 5.0 (medium): The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service…
• CVE-2005-2919 — CVSS 5.0 (medium): libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted…
• CVE-2007-3025 — CVSS 5.0 (medium): Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, when running on Solaris, allows remote…
• CVE-2007-3122 — CVSS 5.0 (medium): The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning via a RAR file with a header…
• CVE-2007-3123 — CVSS 5.0 (medium): unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a…
• CVE-2005-1922 — CVSS 5.0 (medium): The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor…
• CVE-2006-5295 — CVSS 5.0 (medium): Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a…
• CVE-2006-5874 — CVSS 5.0 (medium): Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME…
• CVE-2006-6406 — CVSS 5.0 (medium): Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded…
• CVE-2007-6596 — CVSS 5.0 (medium): ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file.
• CVE-2005-0218 — CVSS 5.0 (medium): ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.
• CVE-2005-0133 — CVSS 5.0 (medium): ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers.
• CVE-2008-1389 — CVSS 5.0 (medium): libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via…
• CVE-2008-1835 — CVSS 5.0 (medium): ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid version number, which cannot be…
• CVE-2008-1837 — CVSS 5.0 (medium): libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RAR files that trigger "memory…
• CVE-2008-2713 — CVSS 5.0 (medium): libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an…
• CVE-2008-3215 — CVSS 5.0 (medium): libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers…
• CVE-2004-0270 — CVSS 5.0 (medium): libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded e-mail message with an…
• CVE-2004-1876 — CVSS 4.6 (medium): The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands…
• CVE-2008-1387 — CVSS 4.3 (medium): ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the…
• CVE-2007-4510 — CVSS 4.3 (medium): ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers to cause a denial of service…
• CVE-2007-3725 — CVSS 4.3 (medium): The RAR VM (unrarvm.c) in Clam Antivirus (ClamAV) before 0.91 allows user-assisted remote attackers to cause a denial of service (crash)…
• CVE-2008-5314 — CVSS 4.3 (medium): Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon…
• CVE-2005-1800 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in Jaws Glossary gadget 0.4 to 0.5.1 allows remote attackers to inject arbitrary web script or…
• CVE-2008-1836 — CVSS 4.3 (medium): The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a…
• CVE-2004-1909 — CVSS 2.6 (low): Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives, such as…
• CVE-2005-2056 — CVSS 2.6 (low): The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to cause a denial of service (application…
• CVE-2005-1923 — CVSS 2.6 (low): The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a…
• CVE-2007-3024 — CVSS 2.1 (low): libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the…
• CVE-2007-6595 — CVSS 2.1 (low): ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function…