Published: 03/12/2008 Updated: 29/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Stack consumption vulnerability in libclamav/special.c in ClamAV prior to 0.94.2 allows remote malicious users to cause a denial of service (daemon crash) via a crafted JPEG file, related to the cli_check_jpeg_exploit, jpeg_check_photoshop, and jpeg_check_photoshop_8bim functions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
clam anti-virus clamav 0.92
clam anti-virus clamav 0.91.2
clam anti-virus clamav 0.88.6
clam anti-virus clamav 0.88.5
clam anti-virus clamav 0.87
clam anti-virus clamav 0.86.2
clam anti-virus clamav 0.84
clam anti-virus clamav 0.93.3
clam anti-virus clamav 0.93.1
clam anti-virus clamav 0.90.2
clam anti-virus clamav 0.90.1
clam anti-virus clamav 0.88.2
clam anti-virus clamav 0.88.1
clam anti-virus clamav 0.86
clam anti-virus clamav 0.85
clam anti-virus clamav 0.81
clam anti-virus clamav 0.80
clam anti-virus clamav 0.74
clam anti-virus clamav 0.73
clam anti-virus clamav 0.93
clam anti-virus clamav 0.92.1
clam anti-virus clamav 0.90
clam anti-virus clamav 0.88.7
clam anti-virus clamav 0.88
clam anti-virus clamav 0.87.1
clam anti-virus clamav 0.85.1
clam anti-virus clamav 0.72
clam anti-virus clamav 0.71
clam anti-virus clamav 0.94
clam anti-virus clamav 0.91.1
clam anti-virus clamav 0.91
clam anti-virus clamav 0.90.3
clam anti-virus clamav 0.88.4
clam anti-virus clamav 0.88.3
clam anti-virus clamav 0.86.1
clam anti-virus clamav 0.82
clam anti-virus clamav 0.75.1
clam anti-virus clamav 0.75
clam anti-virus clamav 0.83
clam anti-virus clamav 0.70
clam anti-virus clamav

Ilja van Sprundel discovered that ClamAV did not handle recursive JPEG information If a remote attacker sent a specially crafted JPEG file, ClamAV would crash, leading to a denial of service ...

Debian Bug report logs - #505134 clamav: ClamAV get_unicode_name() off-by-one buffer overflow Package: clamav; Maintainer for clamav is ClamAV Team <pkg-clamav-devel@listsaliothdebianorg>; Source for clamav is src:clamav (PTS, buildd, popcon) Reported by: Stefan Fritsch <sf@sfritschde> Date: Sun, 9 Nov 2008 18:5 ...

Debian Bug report logs - #507624 clamav: recursive stack overflow in jpeg parsing code Package: clamav; Maintainer for clamav is ClamAV Team <pkg-clamav-devel@listsaliothdebianorg>; Source for clamav is src:clamav (PTS, buildd, popcon) Reported by: "Michael Gilbert" <michaelsgilbert@gmailcom> Date: Wed, 3 Dec ...

/* There is a recursive stack overflow in clamav 0933 and 094 (and probably older versions) in the jpeg parsing code it scan's the jpeg file, and if there is a thumbnail, it'll scan that too the thumbnail itself is just another jpeg file and the same jpeg scanning function gets called without checking any kind of recurising limit this can ea ...

CWE-399 http://lurker.clamav.net/message/20081126.150241.55b1e092.en.html https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1266 http://www.openwall.com/lists/oss-security/2008/12/01/8 http://secunia.com/advisories/33016 http://www.debian.org/security/2008/dsa-1680 http://osvdb.org/50363 http://secunia.com/advisories/33317 http://www.securityfocus.com/bid/32555 http://sourceforge.net/project/shownotes.php?group_id=86638&release_id=643134 http://security.gentoo.org/glsa/glsa-200812-21.xml http://www.ubuntu.com/usn/usn-684-1 http://secunia.com/advisories/32926 http://www.securitytracker.com/id?1021296 http://secunia.com/advisories/32936 http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:239 http://secunia.com/advisories/33195 http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html http://secunia.com/advisories/33937 http://support.apple.com/kb/HT3438 http://www.vupen.com/english/advisories/2009/0422 http://www.vupen.com/english/advisories/2008/3311 https://exchange.xforce.ibmcloud.com/vulnerabilities/46985 https://www.exploit-db.com/exploits/7330 https://usn.ubuntu.com/684-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/7330/

CVE-2008-5314

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect