Description
ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.99.3~beta1+dfsg-1 | — |
| Debian 13 | clamav | 0.99.3~beta1+dfsg-1 | — |
| Debian 12 | clamav | 0.99.3~beta1+dfsg-1 | — |
| Debian 7 | clamav | 0.99.4+dfsg-1+deb7u1 | DLA-1307-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | clamav | 0.99.4+addedllvm-0ubuntu0.16.04.1 | USN-3592-1 |
| Ubuntu 14.04 LTS | clamav | 0.99.4+addedllvm-0ubuntu0.14.04.1 | USN-3592-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | clamav | 0.99.4-33.9.1 | SUSE-SU-2018:2323-1, SUSE-SU-2018:0809-1 |
| SLES 12 SP2 | clamav | 0.99.4-33.9.1 | SUSE-SU-2018:2323-2, SUSE-SU-2018:2323-1, SUSE-SU-2018:0809-1 |
| SLES 12 SP1 | clamav | 0.100.1-33.15.2 | SUSE-SU-2018:2323-1 |
| SLES 12 | clamav | 0.100.1-33.15.2 | SUSE-SU-2018:2323-1 |
| SLES 11 SP4 | clamav | 0.99.4-0.20.7.2 | SUSE-SU-2018:0863-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP3 | clamav | 0.99.4-0.20.7.2 | SUSE-SU-2018:0863-1 |
| SLES for SAP 12 SP3 | clamav | 0.99.4-33.9.1 | SUSE-SU-2018:2323-1, SUSE-SU-2018:0809-1 |
| SLES for SAP 12 SP2 | clamav | 0.99.4-33.9.1 | SUSE-SU-2018:2323-1, SUSE-SU-2018:0809-1 |
| SLES for SAP 12 SP1 | clamav | 0.100.1-33.15.2 | SUSE-SU-2018:2323-1 |
| SLES for SAP 11 SP4 | clamav | 0.99.4-0.20.7.2 | SUSE-SU-2018:0863-1 |
| SUSE OpenStack Cloud 7 | clamav | 0.100.1-33.15.2 | SUSE-SU-2018:2323-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | clamav | 0.99.4-0.20.7.2 | SUSE-SU-2018:0863-1 |
| SUSE Enterprise Storage 4 | clamav | 0.100.1-33.15.2 | SUSE-SU-2018:2323-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clamav | 0.103.3-1.4 | openSUSE-SU-2024:10685-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | clamav | 0.99.4-r0 | — |
| Alpine v3.23 | clamav | 0.99.4-r0 | — |
| Alpine v3.22 | clamav | 0.99.4-r0 | — |
| Alpine v3.21 | clamav | 0.99.4-r0 | — |
| Alpine v3.20 | clamav | 0.99.4-r0 | — |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | clamav | 0.99.4-r0 | — |
| Alpine v3.18 | clamav | 0.99.4-r0 | — |
| Alpine v3.17 | clamav | 0.99.4-r0 | — |
| Alpine v3.16 | clamav | 0.99.4-r0 | — |
| Alpine v3.15 | clamav | 0.99.4-r0 | — |
| Alpine v3.14 | clamav | 0.99.4-r0 | — |
| Alpine v3.13 | clamav | 0.99.4-r0 | — |
| Alpine v3.12 | clamav | 0.99.4-r0 | — |
| Alpine v3.11 | clamav | 0.99.4-r0 | — |
| Alpine v3.10 | clamav | 0.99.4-r0 | — |
| Alpine v3.9 | clamav | 0.99.4-r0 | — |
| Alpine v3.8 | clamav | 0.99.4-r0 | — |
| Alpine v3.7 | clamav | 0.99.4-r0 | — |
| Alpine v3.6 | clamav | 0.99.4-r0 | — |
| Alpine v3.5 | clamav | 0.99.4-r0 | — |
| Alpine v3.4 | clamav | 0.99.4-r0 | — |
Advisories 7
- USN-3592-1 clamav vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-1307-1 clamav - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:2323-2 Security update for clamav SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10685-1 clamav-0.103.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2323-1 Security update for clamav SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0863-1 Security update for clamav SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0809-1 Security update for clamav SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-3592-2 vendor-advisory
- https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6
- [oss-security] 20170929 clamav: Out of bounds read and segfault in xar parser mailing-list
- [debian-lts-announce] 20180316 [SECURITY] [DLA 1307-1] clamav security update mailing-list
- USN-3592-1 vendor-advisory
- GLSA-201804-16 vendor-advisory