Description
Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.88-1 | — |
| Debian 13 | clamav | 0.88-1 | — |
| Debian 12 | clamav | 0.88-1 | — |
| Debian 3.1 | clamav | 0.84-2.sarge.7 | DSA-947-1 |
Advisories 1
- DSA-947-1 clamav - heap overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 342 third-party-advisory
- GLSA-200601-07 vendor-advisory
- 18478 third-party-advisory
- 18379 third-party-advisory
- ADV-2006-0116 vdb-entry
- 16191 vdb-entry
- 18453 third-party-advisory
- 2006-0002 vendor-advisory
- 1015457 vdb-entry
- 18463 third-party-advisory
- clamav-libclamav-upx-bo(24047) vdb-entry
- 22318 vdb-entry
- DSA-947 vendor-advisory
- 20060112 ZDI-06-001: Clam AntiVirus UPX Unpacking Code Execution Vulnerability mailing-list
- http://www.clamav.net/doc/0.88/ChangeLog
- http://www.zerodayinitiative.com/advisories/ZDI-06-001.html
- 18548 third-party-advisory
- MDKSA-2006:016 vendor-advisory
- VU#385908 third-party-advisory