CVE-2017-12374

Priority
Medium
Description
The ClamAV AntiVirus software versions 0.99.2 and prior contain a
vulnerability that could allow an unauthenticated, remote attacker to cause
a denial of service (DoS) condition on an affected device. The
vulnerability is due to a lack of input validation checking mechanisms
during certain mail parsing operations (mbox.c operations on bounce
messages). If successfully exploited, the ClamAV software could allow a
variable pointing to the mail body which could cause a used after being
free (use-after-free) instance which may lead to a disruption of services
on an affected device to include a denial of service condition.
References
Bugs
Assigned-to
mdeslaur
Package
Upstream:released (0.99.3)
Ubuntu 12.04 ESM (Precise Pangolin):released (0.99.3+addedllvm-0ubuntu0.12.04.1)
Ubuntu 14.04 LTS (Trusty Tahr):released (0.99.3+addedllvm-0ubuntu0.14.04.1)
Ubuntu 16.04 LTS (Xenial Xerus):released (0.99.3+addedllvm-0ubuntu0.16.04.1)
Ubuntu 17.10 (Artful Aardvark):released (0.99.3+addedllvm-0ubuntu0.17.10.1)
Ubuntu 18.04 LTS (Bionic Beaver):released (0.99.3+addedllvm-0ubuntu1)
More Information

Updated: 2018-02-13 21:14:44 UTC (commit 14189)