Description
Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.88.2 | — |
| Debian 13 | clamav | 0.88.2 | — |
| Debian 12 | clamav | 0.88.2 | — |
| Debian 3.1 | clamav | 0.84-2.sarge.9 | DSA-1050-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clamav | 0.103.3-1.4 | openSUSE-SU-2024:10685-1 |
Advisories 2
- DSA-1050-1 clamav - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10685-1 clamav-0.103.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- APPLE-SA-2006-06-27 vendor-advisory
- 20159 third-party-advisory
- MDKSA-2006:080 vendor-advisory
- VU#599220 third-party-advisory
- 19963 third-party-advisory
- ADV-2006-1586 vdb-entry
- clamav-freshclam-http-bo(26182) vdb-entry
- 1016392 vdb-entry
- 19964 third-party-advisory
- 2006-0024 vendor-advisory
- 19912 third-party-advisory
- SUSE-SA:2006:025 vendor-advisory
- 19880 third-party-advisory
- http://www.clamav.net/security/0.88.2.html
- http://kolab.org/security/kolab-vendor-notice-09.txt
- 25120 vdb-entry
- SUSE-SR:2006:010 vendor-advisory
- 20117 third-party-advisory
- DSA-1050 vendor-advisory
- GLSA-200605-03 vendor-advisory
- 20877 third-party-advisory
- ADV-2006-2566 vdb-entry
- 17754 vdb-entry
- 19874 third-party-advisory