7.5

CVE-2006-4018

Exploit
Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Clamav ≫ Clamav Version0.81
Clamav ≫ Clamav Version0.81 Updaterc1
Clamav ≫ Clamav Version0.82
Clamav ≫ Clamav Version0.83
Clamav ≫ Clamav Version0.84
Clamav ≫ Clamav Version0.84 Updaterc1
Clamav ≫ Clamav Version0.84 Updaterc2
Clamav ≫ Clamav Version0.85
Clamav ≫ Clamav Version0.85.1
Clamav ≫ Clamav Version0.86
Clamav ≫ Clamav Version0.86 Updaterc1
Clamav ≫ Clamav Version0.86.1
Clamav ≫ Clamav Version0.86.2
Clamav ≫ Clamav Version0.87
Clamav ≫ Clamav Version0.87.1
Clamav ≫ Clamav Version0.88
Clamav ≫ Clamav Version0.88.1
Clamav ≫ Clamav Version0.88.2
Clamav ≫ Clamav Version0.88.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 19.06% 0.97
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://www.trustix.org/errata/2006/0046/
http://kolab.org/security/kolab-vendor-notice-10.txt
http://secunia.com/advisories/21368
Vendor Advisory
http://secunia.com/advisories/21374
Vendor Advisory
http://secunia.com/advisories/21433
Vendor Advisory
http://secunia.com/advisories/21443
Vendor Advisory
http://secunia.com/advisories/21457
Vendor Advisory
http://secunia.com/advisories/21497
Vendor Advisory
http://secunia.com/advisories/21562
Vendor Advisory
http://security.gentoo.org/glsa/glsa-200608-13.xml
http://securitytracker.com/id?1016645
http://www.clamav.net/security/0.88.4.html
Patch
Vendor Advisory
Exploit
http://www.debian.org/security/2006/dsa-1153
http://www.mandriva.com/security/advisories?name=MDKSA-2006:138
http://www.novell.com/linux/security/advisories/2006_46_clamav.html
http://www.overflow.pl/adv/clamav_upx_heap.txt
Patch
Vendor Advisory
Exploit
http://www.securityfocus.com/archive/1/442681/100/0/threaded
http://www.securityfocus.com/bid/19381
http://www.vupen.com/english/advisories/2006/3175
Vendor Advisory
http://www.vupen.com/english/advisories/2006/3275
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28286