Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
ClamAV libclamav/pe.c MEW PE文件整数溢出漏洞
Vulnerability Description
Clam AntiVirus是Unix的GPL杀毒工具包，很多邮件网关产品都在使用。 ClamAV中负责解析MEW包装的PE文件的代码存在整数溢出漏洞，本地攻击者可能利用此漏洞提升自己的权限。 在解压过程中，cli_scanpe()函数未经验证用户提供ssize和dsize参数值便直接用于计算所要分配堆缓冲区的大小，这样就可能分配不充分的大小，之后的操作就会导致用用户提供的数据覆盖任意内存区域。
CVSS Information
N/A
Vulnerability Type
N/A