GCVE - cpe:2.3:a:clamav:clamav:0.99.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:clamav:clamav:0.99.2:*:*:*:*:*:*:*

part: a version: 0.99.2 update: *

Vendor	Clamav (`1e757e73-0a07-5655-8f9d-e7b1c408ae90`)
Product	Clamav (`6bd50a90-3838-55b3-b790-e75ee7286993`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/clamav`	purl2cpe	2026-06-01 10:12:02.740756
`pkg:deb/ubuntu/clamav`	purl2cpe	2026-06-01 10:12:02.740757
`pkg:docker/clamav/clamav`	purl2cpe	2026-06-01 10:12:02.740759
`pkg:github/cisco-talos/clamav`	purl2cpe	2026-06-01 10:12:02.740760
`pkg:rpm/fedora/clamav`	purl2cpe	2026-06-01 10:12:02.740761
`pkg:rpm/opensuse/clamav`	purl2cpe	2026-06-01 10:12:02.740763

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-6420`	vulnerable	2026-06-08 05:09:51.240945	Details available The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. Published: 2017-08-07T03:00:00.000Z Updated: 2024-08-05T15:25:49.281Z Open on db.gcve.eu Reference links https://bugzilla.clamav.net/show_bug.cgi?id=11798 https://github.com/varsleak/varsleak-vul/blob/master/clamav-vul/use-after-free/clamav-use-after-free-pe.md https://security.gentoo.org/glsa/201804-16 https://github.com/vrtadmin/clamav-devel/commit/dfc00cd3301a42b571454b51a6102eecf58407bc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6419`	not_vulnerable	2026-06-08 05:09:51.238329	Details available mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. Published: 2017-08-07T03:00:00.000Z Updated: 2024-08-05T15:25:49.286Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/02/msg00014.html http://www.debian.org/security/2017/dsa-3946 https://github.com/varsleak/varsleak-vul/blob/master/clamav-vul/heap-overflow/clamav_chm_crash.md https://bugzilla.clamav.net/show_bug.cgi?id=11701 https://security.gentoo.org/glsa/201804-16	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6418`	vulnerable	2026-06-08 05:09:51.236793	Details available libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. Published: 2017-08-07T03:00:00.000Z Updated: 2024-08-05T15:25:49.287Z Open on db.gcve.eu Reference links https://github.com/varsleak/varsleak-vul/blob/master/clamav-vul/heap-overflow/clamav_email_crash.md https://bugzilla.clamav.net/show_bug.cgi?id=11797 http://www.securityfocus.com/bid/100154 https://github.com/vrtadmin/clamav-devel/commit/586a5180287262070637c8943f2f7efd652e4a2c https://security.gentoo.org/glsa/201804-16	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-11423`	not_vulnerable	2026-06-08 05:08:37.570176	Details available The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. Published: 2017-07-18T20:00:00.000Z Updated: 2024-08-05T18:12:39.485Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/02/msg00014.html http://www.debian.org/security/2017/dsa-3946 https://github.com/hackerlib/hackerlib-vul/tree/master/clamav-vul https://security.gentoo.org/glsa/201804-16 https://bugzilla.clamav.net/show_bug.cgi?id=11873	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.