CVE-2018-15378

Name
CVE-2018-15378
Description
A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Permissions Required https://secuniaresearch.flexerasoftware.com/advisories/83000/
Issue Tracking https://bugzilla.clamav.net/show_bug.cgi?id=12170
Third Party Advisory https://usn.ubuntu.com/3789-1/
Third Party Advisory https://usn.ubuntu.com/3789-2/
Mailing List https://lists.debian.org/debian-lts-announce/2018/10/msg00014.html
Third Party Advisory https://www.flexera.com/company/secunia-research/advisories/SR-2018-23.html
Third Party Advisory https://security.gentoo.org/glsa/201904-12

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* clamav >= None < 0.100.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
clamav edge-community 0.100.2-r0 None fixed
clamav edge-community 0.100.1-r0 None possibly vulnerable
clamav edge-community 0.99.4-r0 None possibly vulnerable
clamav edge-community 0.99.3-r0 None possibly vulnerable
clamav 3.22-community 0.100.2-r0 None fixed
clamav 3.22-community 0.100.1-r0 None possibly vulnerable
clamav 3.22-community 0.99.4-r0 None possibly vulnerable
clamav 3.22-community 0.99.3-r0 None possibly vulnerable
clamav 3.21-community 0.100.2-r0 None fixed
clamav 3.20-community 0.100.2-r0 None fixed
clamav 3.19-community 0.100.2-r0 None fixed
clamav 3.18-community 0.100.2-r0 None fixed
clamav 3.17-community 0.100.2-r0 None fixed
clamav 3.12-main 0.100.2-r0 None fixed
clamav 3.11-main 0.100.2-r0 None fixed
clamav 3.10-main 0.100.2-r0 None fixed