CVE-2010-0098

Publication date 8 April 2010

Last updated 24 July 2024

Ubuntu priority

Description

ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
clamav	9.10 karmic	Fixed in 0.95.3+dfsg-1ubuntu0.09.10.1
	9.04 jaunty	Fixed in 0.95.3+dfsg-1ubuntu0.09.04.1
	8.10 intrepid	Fixed in 0.95.3+dfsg-1ubuntu0.09.04~intrepid3
	8.04 LTS hardy	Fixed in 0.95.3+dfsg-1ubuntu0.09.04~hardy2.3
	6.06 LTS dapper	Fixed in 0.95.3+dfsg-1ubuntu0.09.04~dapper3

Notes

jdstrand

scan bypass via crafted CAB files

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
clamav	Debdiff: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/553266

References

Related Ubuntu Security Notices (USN)

USN-926-1
ClamAV vulnerabilities
8 April 2010