Gentoo Logo

Clam AntiVirus: Multiple vulnerabilities


1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200909-04 / clamav
Release Date September 09, 2009
Latest Revision September 09, 2009: 01
Impact normal
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
app-antivirus/clamav < 0.95.2 >= 0.95.2 All supported architectures

Related bugreports: #264834, #265545


Multiple vulnerabilities in ClamAV allow for the remote execution of arbitrary code or Denial of Service.

2.  Impact Information


Clam AntiVirus (short: ClamAV) is an anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways.


Multiple vulnerabilities have been found in ClamAV:

  • The vendor reported a Divide-by-zero error in the PE ("Portable Executable"; Windows .exe) file handling of ClamAV (CVE-2008-6680).
  • Jeffrey Thomas Peckham found a flaw in libclamav/untar.c, possibly resulting in an infinite loop when processing TAR archives in clamd and clamscan (CVE-2009-1270).
  • Martin Olsen reported a vulnerability in the CLI_ISCONTAINED macro in libclamav/others.h, when processing UPack archives (CVE-2009-1371).
  • Nigel disclosed a stack-based buffer overflow in the "cli_url_canon()" function in libclamav/phishcheck.c when processing URLs (CVE-2009-1372).


A remote attacker could entice a user or automated system to process a specially crafted UPack archive or a file containing a specially crafted URL, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service. Furthermore, a remote attacker could cause a Denial of Service by supplying a specially crafted TAR archive or PE executable to a Clam AntiVirus instance.

3.  Resolution Information


There is no known workaround at this time.


All Clam AntiVirus users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.95.2"

4.  References


Page updated September 09, 2009

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2015 Gentoo Foundation, Inc. Questions, Comments? Contact us.