ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade clamav | Aug 23, 2018 | Jul 16, 2018 |
| Debian | — | Upgrade clamav | Feb 19, 2019 | Jul 16, 2018 |
| Freebsd | — | Upgrade clamav | Jul 10, 2018 | Jul 9, 2018 |
| Gentoo Linux | — | Upgrade app-antivirus/clamav. | Apr 12, 2019 | Jul 16, 2018 |
| Suse | — | Upgrade libclamav7Upgrade libclammspack0Upgrade clamav-develUpgrade clamavUpgrade libclamav9Upgrade libfreshclam2 | Aug 8, 2018 | Jul 9, 2018 |
| Ubuntu | — | Upgrade clamav | Aug 2, 2018 | Jul 9, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub