Description
Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-824-1 clamav - infinite loop, buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-19-1 clamav - buffer overflow and infinate loop problems Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2005:055 vendor-advisory
- 16989 third-party-advisory
- DSA-824 vendor-advisory
- VU#363713 third-party-advisory
- GLSA-200509-13 vendor-advisory
- 16848 third-party-advisory
- 19506 vdb-entry
- clam-antivirus-upx-bo(22307) vdb-entry
- 14866 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=356974
- ADV-2005-1774 vdb-entry