CVE-2007-1745 - The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2

CVE-2007-1745

Summary

The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897. NOTE: some of these details are obtained from third party information.

References

Vulnerable Configurations

cpe:2.3:a:clam_anti-virus:clamav:*:*:*:*:*:*:*:*
cpe:2.3:a:clam_anti-virus:clamav:*:*:*:*:*:*:*:*
cpe:2.3:a:ifenslave:ifenslave:0.88:*:*:*:*:*:*:*
cpe:2.3:a:ifenslave:ifenslave:0.88:*:*:*:*:*:*:*

CVSS

Base:	7.1 (as of 29-07-2017 - 01:30)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:C

refmap via4

apple	APPLE-SA-2008-03-18
bid	23473
confirm	http://docs.info.apple.com/article.html?artnum=307562 http://sourceforge.net/project/shownotes.php?release_id=500765 http://support.novell.com/techcenter/psdb/50a5cb718f20761dd7e0b6b4e0935c52.html
debian	DSA-1281
gentoo	GLSA-200704-21
mandriva	MDKSA-2007:098
osvdb	34913
secunia	24891 24920 24946 24996 25022 25028 25189 29420
suse	SUSE-SA:2007:026
trustix	2007-0013
vupen	ADV-2007-1378 ADV-2008-0924
xf	clamav-chmdecompressstream-dos(33636)

Last major update

29-07-2017 - 01:30

Published

16-04-2007 - 21:19

Last modified

29-07-2017 - 01:30