ClamAV < 0.92.0 PE File Handling Integer Overflow (deprecated)

high Nessus Network Monitor Plugin ID 4321


The remote host is vulnerable to a buffer overflow.


The remote host is running the ClamAV antivirus client.

This version of ClamAV is vulnerable to a remote integer overflow due to a content-parsing flaw when handling malformed PE files. An attacker exploiting this flaw would only need the ability to send a malformed attachment to a system protected by ClamAV. Successful exploitation would result in the attacker overwriting critical memory blocks and either crashing the service or executing arbitrary code.


Upgrade to version 0.92.0 or higher.

See Also

Plugin Details

Severity: High

ID: 4321

Family: Web Clients

Published: 12/19/2007

Updated: 3/6/2019

Risk Information


Risk Factor: Medium

Score: 6.3


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P


Risk Factor: High

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Reference Information

CVE: CVE-2007-6335, CVE-2007-6336, CVE-2007-6337, CVE-2007-6595, CVE-2007-6596

BID: 27064, 26946, 27063, 26927