VulnerabilityModified
CVE-2006-1615
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code.
HIGH 10.0EPSS 11.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 11.35% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-134
- Affected
- clamav/clamav
- Source
- cve@mitre.org
References
- http://lists.apple.com/archives/security-announce/2006/May/msg00003.html
- http://lists.suse.com/archive/suse-security-announce/2006-Apr/0002.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/19534Patch, Vendor Advisory
- http://secunia.com/advisories/19536Patch, Vendor Advisory
- http://secunia.com/advisories/19564Patch, Vendor Advisory
- http://secunia.com/advisories/19567Vendor Advisory
- http://secunia.com/advisories/19570Patch, Vendor Advisory
- http://secunia.com/advisories/19608Patch, Vendor Advisory
- http://secunia.com/advisories/20077Vendor Advisory
- http://secunia.com/advisories/23719Vendor Advisory
- http://sourceforge.net/project/shownotes.php?release_id=407078&group_id=86638Patch
- http://up2date.astaro.com/2006/05/low_up2date_6202.html
- http://www.debian.org/security/2006/dsa-1024Patch, Vendor Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200604-06.xmlPatch, Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:067
- http://www.osvdb.org/24458
- http://www.securityfocus.com/bid/17388Patch
- http://www.securityfocus.com/bid/17951
- http://www.trustix.org/errata/2006/0020
- http://www.us-cert.gov/cas/techalerts/TA06-132A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2006/1258Vendor Advisory
- http://www.vupen.com/english/advisories/2006/1779Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25661
- http://lists.apple.com/archives/security-announce/2006/May/msg00003.html
- http://lists.suse.com/archive/suse-security-announce/2006-Apr/0002.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/19534Patch, Vendor Advisory
- http://secunia.com/advisories/19536Patch, Vendor Advisory
- http://secunia.com/advisories/19564Patch, Vendor Advisory
- http://secunia.com/advisories/19567Vendor Advisory
- http://secunia.com/advisories/19570Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.