CVE-2010-4260

2010-12-0700:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.162 Low

EPSS

Percentile

95.9%

JSON

Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before
0.96.5 allow remote attackers to cause a denial of service (application
crash) or possibly execute arbitrary code via a crafted PDF document, aka
(1) “bb #2358” and (2) “bb #2396.”

Bugs

<https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/673654>

Notes

Author	Note
jdstrand	0.96 only. Affected code in libclamav/pdf.c:find_stream_bounds(), filter_flatedecode(), and find_length(), none of which are in 0.95. the affected code was introduced in patch series culminating in 208ecece9c657b4e2a3e9d3ce9b6c58f471d7884 (“New PDF parser with better javascript support (bb #1596)”

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchclamav< 0.96.3+dfsg-2ubuntu1.0.10.04.2UNKNOWN
ubuntu10.10noarchclamav< 0.96.3+dfsg-2ubuntu1.2UNKNOWN