CVE catalog

CVE-2012-1457

clamav: CVE-2012-1457

Severity: Medium
Published: Mar 21, 2012, 10:11:49 AM UTC
Source: [NVD] · [CVE record]
EPSS: 98.33% · Oct 25, 2026

The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	clamav	sid	`1.4.6+dfsg-1`	fixed
Debian	clamav	forky	`1.4.6+dfsg-1`	fixed
Debian	clamav	trixie	`1.4.3+dfsg-1`	fixed
Debian	clamav	bookworm	`1.4.3+dfsg-1~deb12u2`	fixed
Debian	clamav	bookworm-security	`1.4.6+dfsg-0+deb12u1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	clamav	source	sid	`0.97.5+dfsg-1`	low	Not reported	[668273]
Debian	clamav	source	forky	`0.97.5+dfsg-1`	low	Not reported	[668273]
Debian	clamav	source	trixie	`0.97.5+dfsg-1`	low	Not reported	[668273]
Debian	clamav	source	bookworm	`0.97.5+dfsg-1`	low	Not reported	[668273]

[Debian bug #668273]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[clamav]Fixed
Details (2)
- 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamav-base]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamav-daemon]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamav-doc]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamav-docs]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamav-freshclam]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamav-milter]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamav-testfiles]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[clamdscan]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[libclamav12]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
[libclamav-dev]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12
- 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

[Debian 13 (Trixie)]

[clamav]Fixed
Details (2)
- 1.4.3+dfsg-1 · amd64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · arm64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamav-base]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamav-daemon]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · amd64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · arm64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamav-doc]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamav-docs]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamav-freshclam]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · amd64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · arm64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamav-milter]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · amd64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · arm64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamav-testfiles]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · all · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
[clamdscan]Fixed
Source package: [clamav]
Details (2)
- 1.4.3+dfsg-1 · amd64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13
- 1.4.3+dfsg-1 · arm64 · trixie
  Fixed · Fixed: 0.97.5+dfsg-1
  dsa · clamav · debian · 13

Next results

Observed: Oct 23, 2026, 5:05:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]