CVE-2017-6419high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
References
http://www.debian.org/security/2017/dsa-3946
https://bugzilla.clamav.net/show_bug.cgi?id=11701
https://github.com/varsleak/varsleak-vul/blob/master/clamav-vul/heap-overflow/clamav_chm_crash.md
https://github.com/vrtadmin/clamav-devel/commit/a83773682e856ad6529ba6db8d1792e6d515d7f1
https://lists.debian.org/debian-lts-announce/2018/02/msg00014.html
Details
Source: MITRE
Published: 2017-08-07
Updated: 2018-10-21
Type: CWE-119
Risk Information
CVSS v2
Base Score: 6.8
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3
Base Score: 7.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 1.8
Severity: HIGH
Vulnerable Software
Configuration 1
AND
OR
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 132144 | EulerOS 2.0 SP3 : libmspack (EulerOS-SA-2019-2609) | Nessus | Huawei Local Security Checks | high |
| 131808 | EulerOS 2.0 SP5 : libmspack (EulerOS-SA-2019-2534) | Nessus | Huawei Local Security Checks | high |
| 131608 | EulerOS 2.0 SP2 : libmspack (EulerOS-SA-2019-2454) | Nessus | Huawei Local Security Checks | high |
| 121949 | Photon OS 2.0: Libmspack PHSA-2018-2.0-0050 | Nessus | PhotonOS Local Security Checks | critical |
| 121842 | Photon OS 1.0: Libmspack PHSA-2018-1.0-0140 | Nessus | PhotonOS Local Security Checks | high |
| 111305 | Photon OS 2.0 : perl / libmspack / zsh (PhotonOS-PHSA-2018-2.0-0050) (deprecated) | Nessus | PhotonOS Local Security Checks | critical |
| 111270 | Photon OS 1.0 : libmspack (PhotonOS-PHSA-2018-1.0-0140) (deprecated) | Nessus | PhotonOS Local Security Checks | high |
| 109230 | GLSA-201804-16 : ClamAV: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | critical |
| 108829 | SUSE SLES11 Security Update : clamav (SUSE-SU-2018:0863-1) | Nessus | SuSE Local Security Checks | critical |
| 108652 | SUSE SLED12 / SLES12 Security Update : clamav (SUSE-SU-2018:0809-1) | Nessus | SuSE Local Security Checks | critical |
| 108637 | openSUSE Security Update : clamav (openSUSE-2018-314) | Nessus | SuSE Local Security Checks | critical |
| 108601 | Amazon Linux AMI : clamav (ALAS-2018-976) | Nessus | Amazon Linux Local Security Checks | critical |
| 108311 | Fedora 26 : clamav (2018-d2b08aa37f) | Nessus | Fedora Local Security Checks | critical |
| 107169 | Fedora 27 : clamav (2018-602b5345fa) | Nessus | Fedora Local Security Checks | critical |
| 106935 | Amazon Linux AMI : clamav (ALAS-2018-958) | Nessus | Amazon Linux Local Security Checks | critical |
| 106780 | Debian DLA-1279-1 : clamav security update | Nessus | Debian Local Security Checks | high |
| 106639 | Fedora 26 : clamav (2018-958b22c73f) | Nessus | Fedora Local Security Checks | critical |
| 106465 | Fedora 27 : clamav (2018-cb339851e7) | Nessus | Fedora Local Security Checks | critical |
| 106456 | SUSE SLED12 / SLES12 Security Update : clamav (SUSE-SU-2018:0255-1) | Nessus | SuSE Local Security Checks | critical |
| 106455 | SUSE SLES11 Security Update : clamav (SUSE-SU-2018:0254-1) | Nessus | SuSE Local Security Checks | critical |
| 106431 | openSUSE Security Update : clamav (openSUSE-2018-102) | Nessus | SuSE Local Security Checks | critical |
| 105828 | Fedora 27 : libmspack (2017-1af202a86b) | Nessus | Fedora Local Security Checks | high |
| 103904 | Fedora 25 : libmspack (2017-b97f9d82dc) | Nessus | Fedora Local Security Checks | high |
| 103437 | Fedora 26 : libmspack (2017-982bfabc4e) | Nessus | Fedora Local Security Checks | high |
| 102598 | Debian DSA-3946-1 : libmspack - security update | Nessus | Debian Local Security Checks | high |
| 102582 | Ubuntu 16.04 LTS / 17.04 : libmspack vulnerabilities (USN-3394-1) | Nessus | Ubuntu Local Security Checks | high |
| 102581 | Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : clamav vulnerabilities (USN-3393-1) | Nessus | Ubuntu Local Security Checks | high |