CVE-2017-12374 (High) detected in multiple libraries - autoclosed

[mend-bolt-for-github[bot]]

CVE-2017-12374 - High Severity Vulnerability

Vulnerable Libraries - clamavclamav-0.88, clamavclamav-0.97.5, clamavclamav-0.88.6, clamavclamav-0.90rc1, switchfinblackfin-linux-dist-2011R1-RC3, clamav-develclamav-0.97, clamav-develclamav-0.84, winpenpackclamwin-0.97.2, clamav-develclamav-0.90.1, salix-sboclamav-0.97.5, clamav-develclamav-0.98.4

Vulnerability Details

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.

Publish Date: 2018-01-26

URL: CVE-2017-12374

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12374

Release Date: 2018-01-26

Fix Resolution: clamav-0.99.3-beta2

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.