ALPINE-CVE-2018-0202

    Dashboard / Vulnerabilities / ALPINE-CVE-2018-0202

    ALPINE-CVE-2018-0202

    Published: 27 Mar 2018Last Modified: 19 Nov 2025
    Upstream:
    CVE-2018-0202

    Summary:

    Details: clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.

    References: https://security.alpinelinux.org/vuln/CVE-2018-0202

    Affected packages

    Package

    Name: clamav

    Purl: pkg:apk/alpine/clamav?arch=source

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.99.4-r0

    Affected versions

    0.94.2-r0
    0.94.2-r1
    0.94.2-r2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    ALPINE-CVE-2018-0202 | CVE-DB