Unscored severity · published May 1, 2006
CVE-2006-1989
Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP…
–
CVSS
5.9%
EPSS
No
On KEV
Description
Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.9% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clamav · Clam Anti-virus
0.88; 0.88.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1989
kolab.org
http://kolab.org/security/kolab-vendor-notice-09.txt
lists.apple.com
http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html
lists.suse.com
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
secunia.com
http://secunia.com/advisories/19874
Exploit
http://secunia.com/advisories/19880
secunia.com
http://secunia.com/advisories/19912
More from Clamav
–
CVE-2008-5314
Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related…
–
CVE-2008-5050
Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash)…
–
CVE-2008-1389
libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an…
–
CVE-2008-3215
libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access
–
CVE-2008-2713
libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read