Description
Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.88.7-1 | — |
| Debian 13 | clamav | 0.88.7-1 | — |
| Debian 12 | clamav | 0.88.7-1 | — |
| Debian 3.1 | clamav | 0.84-2.sarge.13 | DSA-1238-1 |
Advisories 1
- DSA-1238-1 clamav Debian Security (DSA / DLA) · Mar 9, 2026
References
- 31283 vdb-entry
- 21609 vdb-entry
- http://kolab.org/security/kolab-vendor-notice-14.txt
- 23460 third-party-advisory
- 23347 third-party-advisory
- 23404 third-party-advisory
- ADV-2006-4948 vdb-entry
- ADV-2008-0924 vdb-entry
- DSA-1238 vendor-advisory
- 23417 third-party-advisory
- GLSA-200612-18 vendor-advisory
- 2006-0072 vendor-advisory
- SUSE-SA:2006:078 vendor-advisory
- 29420 third-party-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- 23379 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307562
- http://www.quantenblog.net/security/virus-scanner-bypass
- MDKSA-2006:230 vendor-advisory
- ADV-2006-5113 vdb-entry
- 23411 third-party-advisory
- 23362 third-party-advisory