Description
The unmew11 function in libclamav/mew.c in libclamav in ClamAV before 0.92.1 has unknown impact and attack vectors that trigger "heap corruption."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.92.1~dfsg-1 | — |
| Debian 13 | clamav | 0.92.1~dfsg-1 | — |
| Debian 12 | clamav | 0.92.1~dfsg-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clamav | 0.103.3-1.4 | openSUSE-SU-2024:10685-1 |
Advisories 1
- openSUSE-SU-2024:10685-1 clamav-0.103.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- MDVSA-2008:088 vendor-advisory
- 29048 third-party-advisory
- http://support.novell.com/techcenter/psdb/512985d2cd3090bfb93dcb7b551179cf.html
- http://sourceforge.net/project/shownotes.php?release_id=575703
- 29026 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=209915
- ADV-2008-0924 vdb-entry
- ADV-2008-0503 vdb-entry
- 29420 third-party-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- SUSE-SR:2008:004 vendor-advisory
- clamav-mewc-heap-corruption(40474) vdb-entry
- ADV-2008-0606 vdb-entry
- 28907 third-party-advisory
- GLSA-200802-09 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307562
- 29001 third-party-advisory
- http://kolab.org/security/kolab-vendor-notice-19.txt
- 29060 third-party-advisory