Published: 01/12/2014 Updated: 30/04/2015

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV prior to 0.98.5 allows remote malicious users to cause a denial of service (crash) via a crafted y0da Crypter PE file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
clamav clamav
clamav clamav 0.93
clamav clamav 0.92_p0
clamav clamav 0.91
clamav clamav 0.90
clamav clamav 0.88.7
clamav clamav 0.88.6
clamav clamav 0.87.1
clamav clamav 0.87
clamav clamav 0.84
clamav clamav 0.80
clamav clamav 0.74
clamav clamav 0.73
clamav clamav 0.72
clamav clamav 0.67
clamav clamav 0.66
clamav clamav 0.51
clamav clamav 0.3
clamav clamav 0.14
clamav clamav 0.13
clamav clamav 0.93.2
clamav clamav 0.93.1
clamav clamav 0.91.1
clamav clamav 0.90.1_p0
clamav clamav 0.90.1
clamav clamav 0.88.7_p1
clamav clamav 0.88.7_p0
clamav clamav 0.88.1
clamav clamav 0.88
clamav clamav 0.85
clamav clamav 0.80_rc
clamav clamav 0.75.1
clamav clamav 0.75
clamav clamav 0.68
clamav clamav 0.67-1
clamav clamav 0.53
clamav clamav 0.52
clamav clamav 0.20
clamav clamav 0.15
clamav clamav 0.02
clamav clamav 0.01
clamav clamav 0.94.2
clamav clamav 0.94.1
clamav clamav 0.92.1
clamav clamav 0.92
clamav clamav 0.90.3_p1
clamav clamav 0.90.3_p0
clamav clamav 0.88.5
clamav clamav 0.88.4
clamav clamav 0.86.2
clamav clamav 0.86.1
clamav clamav 0.86
clamav clamav 0.83
clamav clamav 0.82
clamav clamav 0.71
clamav clamav 0.70
clamav clamav 0.65
clamav clamav 0.60p
clamav clamav 0.24
clamav clamav 0.23
clamav clamav 0.12
clamav clamav 0.10
clamav clamav 0.94
clamav clamav 0.93.3
clamav clamav 0.91.2_p0
clamav clamav 0.91.2
clamav clamav 0.90.3
clamav clamav 0.90.2_p0
clamav clamav 0.90.2
clamav clamav 0.9
clamav clamav 0.88.3
clamav clamav 0.88.2
clamav clamav 0.85.1
clamav clamav 0.81
clamav clamav 0.8
clamav clamav 0.68.1
clamav clamav 0.60
clamav clamav 0.54
clamav clamav 0.22
clamav clamav 0.21
clamav clamav 0.05
clamav clamav 0.03

Debian Bug report logs - #770985 clamav: CVE-2014-9050: heap buffer overflow when scanning a specially crafted y0da Crypter obfuscated PE file Package: clamav; Maintainer for clamav is ClamAV Team <pkg-clamav-devel@listsaliothdebianorg>; Source for clamav is src:clamav (PTS, buildd, popcon) Reported by: Ralf Hildebrandt & ...

ClamAV could be made to crash or run programs if it processed a specially crafted file ...

CWE-119 http://secunia.com/advisories/59645 http://secunia.com/advisories/62542 http://blog.clamav.net/2014/11/clamav-0985-has-been-released.html http://www.securityfocus.com/bid/71242 http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144979.html http://www.openwall.com/lists/oss-security/2014/11/22/1 https://github.com/vrtadmin/clamav-devel/commit/fc3794a54d2affe5770c1f876484a871c783e91e http://www.ubuntu.com/usn/USN-2423-1 http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00006.html http://www.securitytracker.com/id/1031268 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770985 https://usn.ubuntu.com/2423-1/https://nvd.nist.gov

CVE-2014-9050

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect