Lucene search

CiscoCVE-2017-12376

HistoryJan 26, 2018 - 8:29 p.m.

CVE-2017-12376

2018-01-2620:29:00

CWE-119

cisco

web.nvd.nist.gov

clamav

vulnerability

cve-2017-12376

denial of service

remote attack

pdf

buffer overflow

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.012

Percentile

85.2%

JSON

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a handle_pdfname (in pdf.c) buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code.

Affected configurations

Nvd

Node

debiandebian_linuxMatch7.0

Node

clamavclamavRange≤0.99.2

VendorProductVersionCPE
debiandebian_linux7.0cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
clamavclamav*cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
debian	debian_linux	7.0	cpe:2.3:o:debian:debian_linux:7.0:::::::*
clamav	clamav	*	cpe:2.3:a:clamav:clamav::::::::

CNA Affected

[
  {
    "product": "ClamAV AntiVirus software versions 0.99.2 and prior",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "ClamAV AntiVirus software versions 0.99.2 and prior"
      }
    ]
  }
]