Description
Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.88.7-1 | — |
| Debian 13 | clamav | 0.88.7-1 | — |
| Debian 12 | clamav | 0.88.7-1 | — |
| Debian 3.1 | clamav | 0.84-2.sarge.13 | DSA-1238-1 |
Advisories 1
- DSA-1238-1 clamav Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21461 vdb-entry
- http://kolab.org/security/kolab-vendor-notice-14.txt
- 23460 third-party-advisory
- ADV-2006-4948 vdb-entry
- DSA-1238 vendor-advisory
- SUSE-SA:2006:078 vendor-advisory
- 20061206 Multiple Vendor Unusual MIME Encoding Content Filter Bypass mailing-list
- 23379 third-party-advisory
- http://www.quantenblog.net/security/virus-scanner-bypass
- MDKSA-2006:230 vendor-advisory
- ADV-2006-5113 vdb-entry
- 23411 third-party-advisory
- 23362 third-party-advisory