Clam AntiVirus is "a multi-platform GPL anti-virus toolkit. The main purpose of which is integration into electronic mail servers". Remote exploitation of a buffer overflow in Clam AntiVirus allows attackers to potentially execute arbitrary code or cause a denial of service condition.
Vulnerable Systems:
* ClamAV version 0.88.1
* ClamAV version 0.88.4
Immune Systems:
* ClamAV version 0.88.5
This vulnerability specifically exists within code dealing PE (Portable Executable) format files. While processing certain PE elements, two variables can be very large and integer overflow could occur. This would result in less memory being allocated than was expected by the programmer and subsequent code would overflow the heap buffer.
