CVE catalog

CVE-2018-0202

clamav: CVE-2018-0202

[CVE catalog]

Severity
Medium · CVSS 5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
2.58% · Oct 27, 2026

clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianclamavsid1.4.6+dfsg-1fixed
Debianclamavforky1.4.6+dfsg-1fixed
Debianclamavtrixie1.4.3+dfsg-1fixed
Debianclamavbookworm1.4.3+dfsg-1~deb12u2fixed
Debianclamavbookworm-security1.4.6+dfsg-0+deb12u1fixed
Ubuntuclamav14.040.97.8+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.97.8+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1.1vulnerable
Ubuntuclamav14.040.98.5+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.6+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.7+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.99.3+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.4+addedllvm-0ubuntu0.14.04.1fixed
Ubuntuclamav16.040.98.7+dfsg-0ubuntu4vulnerable
Ubuntuclamav16.040.98.7+dfsg-0ubuntu5vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.3vulnerable
Ubuntuclamav16.040.99.3+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.4+addedllvm-0ubuntu0.16.04.1fixed
Ubuntuclamav14.040.97.8+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.97.8+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1.1vulnerable
Ubuntuclamav14.040.98.5+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.6+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.7+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.99.3+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.4+addedllvm-0ubuntu0.14.04.1fixed
Ubuntuclamav16.040.98.7+dfsg-0ubuntu4vulnerable
Ubuntuclamav16.040.98.7+dfsg-0ubuntu5vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.3vulnerable
Ubuntuclamav16.040.99.3+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.4+addedllvm-0ubuntu0.16.04.1fixed
Alpineclamav3.100.99.4-r0fixed
Alpineclamav3.110.99.4-r0fixed
Alpineclamav3.120.99.4-r0fixed
Alpineclamav3.130.99.4-r0fixed
Alpineclamav3.40.99.4-r0fixed
Alpineclamav3.50.99.4-r0fixed
Alpineclamav3.60.99.4-r0fixed
Alpineclamav3.70.99.4-r0fixed
Alpineclamav3.80.99.4-r0fixed
Alpineclamav3.90.99.4-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianclamavsourcesid0.100.0~beta+dfsg-2not yet assignedNot reportedNot reported
Debianclamavsourceforky0.100.0~beta+dfsg-2not yet assignedNot reportedNot reported
Debianclamavsourcetrixie0.100.0~beta+dfsg-2not yet assignedNot reportedNot reported
Debianclamavsourcebookworm0.100.0~beta+dfsg-2not yet assignedNot reportedNot reported
Ubuntuclamavdeb14.040.99.4+addedllvm-0ubuntu0.14.04.1Not reportedUBUNTU-CVE-2018-0202Not reported
Ubuntuclamavdeb16.040.99.4+addedllvm-0ubuntu0.16.04.1Not reportedUBUNTU-CVE-2018-0202Not reported
Ubuntuclamavdeb14.040.99.4+addedllvm-0ubuntu0.14.04.1Not reportedUSN-3592-1Not reported
Ubuntuclamavdeb16.040.99.4+addedllvm-0ubuntu0.16.04.1Not reportedUSN-3592-1Not reported
Alpineclamavapk3.100.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.110.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.120.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.130.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.40.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.50.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.60.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.70.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.80.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported
Alpineclamavapk3.90.99.4-r0Not reportedALPINE-CVE-2018-0202Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [clamav]Unknown
    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-base]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-daemon]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-doc]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-docs]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-freshclam]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-milter]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-testfiles]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamdscan]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [libclamav12]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [libclamav-dev]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

[Debian 13 (Trixie)]

  • [clamav]Unknown
    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamav-base]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamav-daemon]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamav-doc]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamav-docs]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamav-freshclam]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamav-milter]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamav-testfiles]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

  • [clamdscan]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.0~beta+dfsg-2

      dsa · clamav · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]