Description
libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.93.1.dfsg-1.1 | — |
| Debian 13 | clamav | 0.93.1.dfsg-1.1 | — |
| Debian 12 | clamav | 0.93.1.dfsg-1.1 | — |
| Debian 5.0 | clamav | 0.93~dfsg-1+lenny1 | DTSA-138-1 |
| Debian 4.0 | clamav | 0.90.1dfsg-3.1etch14 | DSA-1616-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clamav | 0.103.3-1.4 | openSUSE-SU-2024:10685-1 |
Advisories 3
- DSA-1616-2 clamav - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-138-1 clamav - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10685-1 clamav-0.103.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 31437 third-party-advisory
- APPLE-SA-2008-09-15 vendor-advisory
- http://up2date.astaro.com/2008/08/up2date_asg_v7300_ga_released.html
- MDVSA-2008:122 vendor-advisory
- TA08-260A third-party-advisory
- SUSE-SR:2008:015 vendor-advisory
- 30785 third-party-advisory
- ADV-2008-2584 vdb-entry
- [oss-security] 20080615 CVE id request: Clamav mailing-list
- ADV-2008-1855 vdb-entry
- 30967 third-party-advisory
- 31882 third-party-advisory
- 31091 third-party-advisory
- 30657 third-party-advisory
- http://kolab.org/security/kolab-vendor-notice-21.txt
- clamav-petite-dos(43133) vdb-entry
- SUSE-SR:2008:014 vendor-advisory
- DSA-1616 vendor-advisory
- FEDORA-2008-5476 vendor-advisory
- https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1000
- [oss-security] 20080617 Re: CVE id request: Clamav mailing-list
- GLSA-200808-07 vendor-advisory
- 29750 vdb-entry
- 30829 third-party-advisory
- 1020305 vdb-entry
- FEDORA-2008-6422 vendor-advisory
- 31167 third-party-advisory
- 31576 third-party-advisory
- http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&path=/branches/0.93/libclamav/petite.c&rev=3886
- http://sourceforge.net/project/shownotes.php?release_id=605577&group_id=86638
- 31206 third-party-advisory