Unscored severity · published May 17, 2006
CVE-2006-2427
freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local…
–
CVSS
0.5%
EPSS
No
On KEV
Description
freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clamav · Clam Anti-virus
0.88 · source: NVD
CL
Clamxav · Clam Anti-virus
1.0.3h · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2427
Vendor Advisory
http://secunia.com/advisories/20085
securityreason.com
http://securityreason.com/securityalert/912
Exploit
http://securitytracker.com/id?1016086
www.digitalmunition.com
http://www.digitalmunition.com/DMA%5B2006-0514a%5D.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/434008/100/0/threaded
www.vupen.com
http://www.vupen.com/english/advisories/2006/1807
More from Clamav
–
CVE-2008-5314
Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related…
–
CVE-2008-5050
Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash)…
–
CVE-2008-1389
libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an…
–
CVE-2008-3215
libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access
–
CVE-2008-2713
libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read