PublicDateAtUSN: 2018-01-29
Candidate: CVE-2017-12375
PublicDate: 2018-01-26 20:29:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12375
 http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
 https://ubuntu.com/security/notices/USN-3550-1
 https://ubuntu.com/security/notices/USN-3550-2
Description:
 The ClamAV AntiVirus software versions 0.99.2 and prior contain a
 vulnerability that could allow an unauthenticated, remote attacker to cause
 a denial of service (DoS) condition on an affected device. The
 vulnerability is due to a lack of input validation checking mechanisms
 during certain mail parsing functions (the rfc2047 function in mbox.c). An
 unauthenticated, remote attacker could exploit this vulnerability by
 sending a crafted email to the affected device. This action could cause a
 buffer overflow condition when ClamAV scans the malicious email, allowing
 the attacker to potentially cause a DoS condition on an affected device.
Ubuntu-Description: 
Notes: 
Bugs: 
 https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1745635
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]


Patches_clamav:
upstream_clamav: released (0.99.3)
precise/esm_clamav: released (0.99.3+addedllvm-0ubuntu0.12.04.1)
trusty_clamav: released (0.99.3+addedllvm-0ubuntu0.14.04.1)
trusty/esm_clamav: released (0.99.3+addedllvm-0ubuntu0.14.04.1)
xenial_clamav: released (0.99.3+addedllvm-0ubuntu0.16.04.1)
esm-infra/xenial_clamav: released (0.99.3+addedllvm-0ubuntu0.16.04.1)
artful_clamav: released (0.99.3+addedllvm-0ubuntu0.17.10.1)
devel_clamav: released (0.99.3+addedllvm-0ubuntu1)