Homepage

Use After Free Affecting clamav-filesystem package, versions <0:0.99.3-1.28.amzn1

Severity

 Recommended
medium

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.4% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN201803-CLAMAVFILESYSTEM-1710409
  • published27 Sept 2021
  • disclosed26 Jan 2018
Report a new vulnerability Found a mistake?

Introduced: 26 Jan 2018

CVE-2017-12374  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2018.03 clamav-filesystem to version 0:0.99.3-1.28.amzn1 or higher.
This issue was patched in ALAS-2018-958.

NVD Description

Note: Versions mentioned in the description apply only to the upstream clamav-filesystem package and not the clamav-filesystem package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2018.03 relevant fixed versions and status.

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.