CVE-2018-15378 Clam AntiVirus unmew11() Denial of Service Vulnerability

2018-10-0300:00:00

CWE-125

cisco

www.cve.org

6.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the “unmew11()” function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file.

CNA Affected

[
  {
    "product": "ClamAV",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "0.100.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]