CVE catalog

CVE-2012-6706

libclamunrar: CVE-2012-6706

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
10.11% · Oct 25, 2026

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibclamunrarsid1.4.4-1fixed
Debianlibclamunrarforky1.4.4-1fixed
Debianlibclamunrartrixie1.3.1-1fixed
Debianlibclamunrarbookworm1.3.1-1~deb12u1fixed
Debianunrar-nonfreesid1:7.3.1-1fixed
Debianunrar-nonfreeforky1:7.3.1-1fixed
Debianunrar-nonfreetrixie1:7.1.8-1fixed
Debianunrar-nonfreebookworm1:6.2.6-1+deb12u1fixed
Alpineclamav3.100.99.4-r0fixed
Alpineclamav3.110.99.4-r0fixed
Alpineclamav3.120.99.4-r0fixed
Alpineclamav3.130.99.4-r0fixed
Alpineclamav3.80.99.4-r0fixed
Alpineclamav3.90.99.4-r0fixed
Suseclamavlinux enterprise point of sale 11 sp30.99.2-0.19.1fixed
Suseclamavlinux enterprise server 11 sp3-ltss0.99.2-0.19.1fixed
Suseclamavlinux enterprise server 11 sp3-teradata0.99.2-0.19.1fixed
Suseclamavlinux enterprise server 11 sp40.99.2-0.19.1fixed
Suseclamavlinux enterprise server for sap applications 11 sp40.99.2-0.19.1fixed
Suseunraropenstack cloud 65.0.14-3.1fixed
Suseunrarlinux enterprise desktop 12 sp25.0.14-3.1fixed
Suseunrarlinux enterprise server for raspberry pi 12 sp25.0.14-3.1fixed
Suseunrarlinux enterprise server for sap applications 125.0.14-3.1fixed
Suseunrarlinux enterprise server for sap applications 12 sp15.0.14-3.1fixed
Suseunrarlinux enterprise software development kit 12 sp25.0.14-3.1fixed
Suseunrarlinux enterprise server 12-ltss5.0.14-3.1fixed
Suseunrarlinux enterprise server 12 sp1-ltss5.0.14-3.1fixed
Suseunrarlinux enterprise server 12 sp25.0.14-3.1fixed
Suseunrarlinux enterprise server for sap applications 12 sp25.0.14-3.1fixed
Suseunrarlinux enterprise point of sale 11 sp33.80.2-4.1fixed
Suseunrarlinux enterprise server 11 sp3-ltss3.80.2-4.1fixed
Suseunrarlinux enterprise server 11 sp3-teradata3.80.2-4.1fixed
Suseunrarlinux enterprise server 11 sp43.80.2-4.1fixed
Suseunrarlinux enterprise server for sap applications 11 sp43.80.2-4.1fixed
Suseclamavlinux enterprise point of sale 11 sp30.99.4-0.20.7.2fixed
Suseclamavlinux enterprise server 11 sp3-ltss0.99.4-0.20.7.2fixed
Suseclamavlinux enterprise server 11 sp3-teradata0.99.4-0.20.7.2fixed
Suseclamavlinux enterprise server 11 sp40.99.4-0.20.7.2fixed
Suseclamavlinux enterprise server for sap applications 11 sp40.99.4-0.20.7.2fixed
Suseunraropenstack cloud 85.6.1-4.5.1fixed
Suseunraropenstack cloud 95.6.1-4.5.1fixed
Suseunraropenstack cloud crowbar 95.6.1-4.5.1fixed
Suseunrarlinux enterprise server for sap applications 12 sp35.6.1-4.5.1fixed
Suseunrarlinux enterprise server for sap applications 12 sp45.6.1-4.5.1fixed
Suseunrarlinux enterprise software development kit 12 sp55.6.1-4.5.1fixed
Suseunrarlinux enterprise server 12 sp2-bcl5.6.1-4.5.1fixed
Suseunrarlinux enterprise server 12 sp3-ltss5.6.1-4.5.1fixed
Suseunrarlinux enterprise server 12 sp3-bcl5.6.1-4.5.1fixed
Suseunrarlinux enterprise server 12 sp4-ltss5.6.1-4.5.1fixed
Suseunrarlinux enterprise server 12 sp55.6.1-4.5.1fixed
Suseunrarlinux enterprise server for sap applications 12 sp55.6.1-4.5.1fixed
Suseclamavlinux enterprise desktop 12 sp20.99.4-33.9.1fixed
Suseclamavlinux enterprise desktop 12 sp30.99.4-33.9.1fixed
Suseclamavlinux enterprise server for raspberry pi 12 sp20.99.4-33.9.1fixed
Suseclamavlinux enterprise server 12 sp20.99.4-33.9.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp20.99.4-33.9.1fixed
Suseclamavlinux enterprise server 12 sp30.99.4-33.9.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp30.99.4-33.9.1fixed
Suseclamavlinux enterprise desktop 12 sp20.99.2-32.1fixed
Suseclamavlinux enterprise server for raspberry pi 12 sp20.99.2-32.1fixed
Suseclamavlinux enterprise server for sap applications 120.99.2-32.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp10.99.2-32.1fixed
Suseclamavlinux enterprise server 12-ltss0.99.2-32.1fixed
Suseclamavlinux enterprise server 12 sp1-ltss0.99.2-32.1fixed
Suseclamavlinux enterprise server 12 sp20.99.2-32.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp20.99.2-32.1fixed
Suseunrarlinux enterprise server 11 sp45.6.1-5.3.1fixed
Suseunrarlinux enterprise server for sap applications 11 sp45.6.1-5.3.1fixed
Ubuntulibclamunrar14.040.96.4-1vulnerable
Ubuntulibclamunrar14.040.96.4-1ubuntu1vulnerable
Ubuntulibclamunrar14.040.99-0ubuntu0.14.04.1vulnerable
Ubuntulibclamunrar14.040.99-0ubuntu0.14.04.2fixed
Ubuntulibclamunrar16.040.98.5-1vulnerable
Ubuntulibclamunrar16.040.99-1vulnerable
Ubuntulibclamunrar16.040.99-1ubuntu0.1fixed
Ubuntuunrar-nonfree16.041:5.3.2-1vulnerable
Ubuntuunrar-nonfree16.041:5.3.2-1+deb9u1build0.16.04.1fixed
Ubuntulibclamunrar18.040.99-4ubuntu1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibclamunrarsourcesid0.99-4not yet assignedNot reported[867223]
Debianlibclamunrarsourceforky0.99-4not yet assignedNot reported[867223]
Debianlibclamunrarsourcetrixie0.99-4not yet assignedNot reported[867223]
Debianlibclamunrarsourcebookworm0.99-4not yet assignedNot reported[867223]
Debianunrar-nonfreesourcesid1:5.5.5-1not yet assignedNot reported[865461]
Debianunrar-nonfreesourceforky1:5.5.5-1not yet assignedNot reported[865461]
Debianunrar-nonfreesourcetrixie1:5.5.5-1not yet assignedNot reported[865461]
Debianunrar-nonfreesourcebookworm1:5.5.5-1not yet assignedNot reported[865461]
Alpineclamavapk3.100.99.4-r0Not reportedALPINE-CVE-2012-6706Not reported
Alpineclamavapk3.110.99.4-r0Not reportedALPINE-CVE-2012-6706Not reported
Alpineclamavapk3.120.99.4-r0Not reportedALPINE-CVE-2012-6706Not reported
Alpineclamavapk3.130.99.4-r0Not reportedALPINE-CVE-2012-6706Not reported
Alpineclamavapk3.80.99.4-r0Not reportedALPINE-CVE-2012-6706Not reported
Alpineclamavapk3.90.99.4-r0Not reportedALPINE-CVE-2012-6706Not reported
Suseclamavrpmlinux enterprise point of sale 11 sp30.99.2-0.19.1Not reportedSUSE-SU-2017:1763-1Not reported
Suseclamavrpmlinux enterprise server 11 sp3-ltss0.99.2-0.19.1Not reportedSUSE-SU-2017:1763-1Not reported
Suseclamavrpmlinux enterprise server 11 sp3-teradata0.99.2-0.19.1Not reportedSUSE-SU-2017:1763-1Not reported
Suseclamavrpmlinux enterprise server 11 sp40.99.2-0.19.1Not reportedSUSE-SU-2017:1763-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 11 sp40.99.2-0.19.1Not reportedSUSE-SU-2017:1763-1Not reported
Suseunrarrpmopenstack cloud 65.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise desktop 12 sp25.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise server for raspberry pi 12 sp25.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 125.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 12 sp15.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise software development kit 12 sp25.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise server 12-ltss5.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise server 12 sp1-ltss5.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise server 12 sp25.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 12 sp25.0.14-3.1Not reportedSUSE-SU-2017:1745-1Not reported
Suseunrarrpmlinux enterprise point of sale 11 sp33.80.2-4.1Not reportedSUSE-SU-2017:1760-1Not reported
Suseunrarrpmlinux enterprise server 11 sp3-ltss3.80.2-4.1Not reportedSUSE-SU-2017:1760-1Not reported
Suseunrarrpmlinux enterprise server 11 sp3-teradata3.80.2-4.1Not reportedSUSE-SU-2017:1760-1Not reported
Suseunrarrpmlinux enterprise server 11 sp43.80.2-4.1Not reportedSUSE-SU-2017:1760-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 11 sp43.80.2-4.1Not reportedSUSE-SU-2017:1760-1Not reported
Suseclamavrpmlinux enterprise point of sale 11 sp30.99.4-0.20.7.2Not reportedSUSE-SU-2018:0863-1Not reported
Suseclamavrpmlinux enterprise server 11 sp3-ltss0.99.4-0.20.7.2Not reportedSUSE-SU-2018:0863-1Not reported
Suseclamavrpmlinux enterprise server 11 sp3-teradata0.99.4-0.20.7.2Not reportedSUSE-SU-2018:0863-1Not reported
Suseclamavrpmlinux enterprise server 11 sp40.99.4-0.20.7.2Not reportedSUSE-SU-2018:0863-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 11 sp40.99.4-0.20.7.2Not reportedSUSE-SU-2018:0863-1Not reported
Suseunrarrpmopenstack cloud 85.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmopenstack cloud 95.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmopenstack cloud crowbar 95.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 12 sp35.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 12 sp45.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise software development kit 12 sp55.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server 12 sp2-bcl5.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server 12 sp3-ltss5.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server 12 sp3-bcl5.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server 12 sp4-ltss5.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server 12 sp55.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 12 sp55.6.1-4.5.1Not reportedSUSE-SU-2021:2834-1Not reported
Suseclamavrpmlinux enterprise desktop 12 sp20.99.4-33.9.1Not reportedSUSE-SU-2018:0809-1Not reported
Suseclamavrpmlinux enterprise desktop 12 sp30.99.4-33.9.1Not reportedSUSE-SU-2018:0809-1Not reported
Suseclamavrpmlinux enterprise server for raspberry pi 12 sp20.99.4-33.9.1Not reportedSUSE-SU-2018:0809-1Not reported
Suseclamavrpmlinux enterprise server 12 sp20.99.4-33.9.1Not reportedSUSE-SU-2018:0809-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp20.99.4-33.9.1Not reportedSUSE-SU-2018:0809-1Not reported
Suseclamavrpmlinux enterprise server 12 sp30.99.4-33.9.1Not reportedSUSE-SU-2018:0809-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp30.99.4-33.9.1Not reportedSUSE-SU-2018:0809-1Not reported
Suseclamavrpmlinux enterprise desktop 12 sp20.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseclamavrpmlinux enterprise server for raspberry pi 12 sp20.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 120.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp10.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseclamavrpmlinux enterprise server 12-ltss0.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseclamavrpmlinux enterprise server 12 sp1-ltss0.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseclamavrpmlinux enterprise server 12 sp20.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp20.99.2-32.1Not reportedSUSE-SU-2017:1716-1Not reported
Suseunrarrpmlinux enterprise server 11 sp45.6.1-5.3.1Not reportedSUSE-SU-2018:0862-1Not reported
Suseunrarrpmlinux enterprise server for sap applications 11 sp45.6.1-5.3.1Not reportedSUSE-SU-2018:0862-1Not reported
Ubuntulibclamunrardeb14.040.99-0ubuntu0.14.04.2Not reportedUBUNTU-CVE-2012-6706Not reported
Ubuntulibclamunrardeb16.040.99-1ubuntu0.1Not reportedUBUNTU-CVE-2012-6706Not reported
Ubuntuunrar-nonfreedeb16.041:5.3.2-1+deb9u1build0.16.04.1Not reportedUBUNTU-CVE-2012-6706Not reported
Ubuntulibclamunrardeb18.040.99-4ubuntu1Not reportedUBUNTU-CVE-2012-6706Not reported

[Debian bug #867223][Debian bug #865461]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [libclamunrar]

    Details (2)
    • 1.3.1-1~deb12u1 · all · bookworm

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · bookworm; dsa · libclamunrar · debian · 12

    • 1.3.1-1~deb12u1 · all · bookworm

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · bookworm; dsa · libclamunrar · debian · 12

  • Details (2)
    • 1.3.1-1~deb12u1 · all · bookworm

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · bookworm; dsa · libclamunrar · debian · 12

    • 1.3.1-1~deb12u1 · all · bookworm

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · bookworm; dsa · libclamunrar · debian · 12

  • Source package: [libclamunrar]

    Details (2)
    • 1.3.1-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · bookworm; dsa · libclamunrar · debian · 12

    • 1.3.1-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · bookworm; dsa · libclamunrar · debian · 12

  • [libunrar5]Fixed

    Source package: [unrar-nonfree]

    Details (2)
    • 1:6.2.6-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

    • 1:6.2.6-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

  • Source package: [unrar-nonfree]

    Details (2)
    • 1:6.2.6-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

    • 1:6.2.6-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

  • Source package: [unrar-nonfree]

    Details (2)
    • 1:6.2.6-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

    • 1:6.2.6-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

  • [unrar]Fixed

    Source package: [unrar-nonfree]

    Details (2)
    • 1:6.2.6-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

    • 1:6.2.6-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · bookworm; dsa · unrar-nonfree · debian · 12

[Debian 13 (Trixie)]

  • Source package: [libclamunrar]

    Details (2)
    • 1.3.1-1 · all · trixie

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · 13

    • 1.3.1-1 · all · trixie

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · 13

  • Details (2)
    • 1.3.1-1 · all · trixie

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · 13

    • 1.3.1-1 · all · trixie

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · 13

  • Source package: [libclamunrar]

    Details (2)
    • 1.3.1-1 · arm64 · trixie

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · 13

    • 1.3.1-1+b1 · amd64 · trixie

      Fixed · Fixed: 0.99-4

      dsa · libclamunrar · debian · 13

  • Source package: [unrar-nonfree]

    Details (2)
    • 1:7.1.8-1 · amd64 · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

    • 1:7.1.8-1 · arm64 · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

  • Source package: [unrar-nonfree]

    Details (2)
    • 1:7.1.8-1 · amd64 · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

    • 1:7.1.8-1 · arm64 · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

  • Source package: [unrar-nonfree]

    Details (2)
    • 1:7.1.8-1 · all · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

    • 1:7.1.8-1 · all · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

  • [unrar]Fixed

    Source package: [unrar-nonfree]

    Details (2)
    • 1:7.1.8-1 · amd64 · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

    • 1:7.1.8-1 · arm64 · trixie

      Fixed · Fixed: 1:5.5.5-1

      dsa · unrar-nonfree · debian · 13

Observed:

References