Homepage

Use After Free Affecting clamav package, versions <0.99.3-r0

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
4.98% (92nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE323-CLAMAV-14177551
  • published4 Dec 2025
  • disclosed26 Jan 2018
Report a new vulnerability Found a mistake?

Introduced: 26 Jan 2018

CVE-2017-12374  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade Alpine:3.23 clamav to version 0.99.3-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream clamav package and not the clamav package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.