Description
libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FSG packed executable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-824-1 clamav - infinite loop, buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-19-1 clamav - buffer overflow and infinate loop problems Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2005:055 vendor-advisory
- 19507 vdb-entry
- 16989 third-party-advisory
- DSA-824 vendor-advisory
- clam-antivirus-fsg-dos(22308) vdb-entry
- MDKSA-2005:166 vendor-advisory
- GLSA-200509-13 vendor-advisory
- 16848 third-party-advisory
- 14867 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=356974
- ADV-2005-1774 vdb-entry