CVE catalog

CVE-2018-0360

clamav: CVE-2018-0360

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.71% · Oct 25, 2026

ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianclamavsid1.4.6+dfsg-1fixed
Debianclamavforky1.4.6+dfsg-1fixed
Debianclamavtrixie1.4.3+dfsg-1fixed
Debianclamavbookworm1.4.3+dfsg-1~deb12u2fixed
Debianclamavbookworm-security1.4.6+dfsg-0+deb12u1fixed
Ubuntuclamav14.040.97.8+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.97.8+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1.1vulnerable
Ubuntuclamav14.040.98.5+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.6+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.7+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.99.3+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.4+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.1fixed
Ubuntuclamav16.040.98.7+dfsg-0ubuntu4vulnerable
Ubuntuclamav16.040.98.7+dfsg-0ubuntu5vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.3vulnerable
Ubuntuclamav16.040.99.3+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.4+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.100.1+dfsg-1ubuntu0.16.04.1fixed
Ubuntuclamav18.040.99.2+dfsg-6ubuntu2vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu1vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu2vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu2vulnerable
Ubuntuclamav18.040.99.4+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.1fixed
Ubuntuclamav14.040.97.8+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.97.8+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1.1vulnerable
Ubuntuclamav14.040.98.5+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.6+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.7+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.99.3+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.4+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.1fixed
Ubuntuclamav16.040.98.7+dfsg-0ubuntu4vulnerable
Ubuntuclamav16.040.98.7+dfsg-0ubuntu5vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.1vulnerable
Ubuntuclamav16.040.99+dfsg-1ubuntu1.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamav16.040.99.2+dfsg-0ubuntu0.16.04.3vulnerable
Ubuntuclamav16.040.99.3+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.99.4+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamav16.040.100.1+dfsg-1ubuntu0.16.04.1fixed
Ubuntuclamav18.040.99.2+dfsg-6ubuntu2vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu1vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu2vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu2vulnerable
Ubuntuclamav18.040.99.4+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.1fixed
Suseclamavlinux enterprise server 12 sp2-bcl0.100.1-33.15.2fixed
Suseclamavopenstack cloud 70.100.1-33.15.2fixed
Suseclamavlinux enterprise desktop 12 sp30.100.1-33.15.2fixed
Suseclamavlinux enterprise server for sap applications 12 sp10.100.1-33.15.2fixed
Suseclamavlinux enterprise server for sap applications 12 sp20.100.1-33.15.2fixed
Suseclamavlinux enterprise server 12-ltss0.100.1-33.15.2fixed
Suseclamavlinux enterprise server 12 sp1-ltss0.100.1-33.15.2fixed
Suseclamavlinux enterprise server 12 sp2-ltss0.100.1-33.15.2fixed
Suseclamavlinux enterprise server 12 sp30.100.1-33.15.2fixed
Suseclamavlinux enterprise server for sap applications 12 sp30.100.1-33.15.2fixed
Suseclamaventerprise storage 40.100.1-33.15.2fixed
Suseclamavlinux enterprise module for basesystem 150.100.1-3.3.1fixed
Suseclamavlinux enterprise point of sale 11 sp30.100.1-0.20.15.1fixed
Suseclamavlinux enterprise server 11 sp3-ltss0.100.1-0.20.15.1fixed
Suseclamavlinux enterprise server 11 sp3-teradata0.100.1-0.20.15.1fixed
Suseclamavlinux enterprise server 11 sp40.100.1-0.20.15.1fixed
Suseclamavlinux enterprise server for sap applications 11 sp40.100.1-0.20.15.1fixed
Alpineclamav3.100.100.1-r0fixed
Alpineclamav3.110.100.1-r0fixed
Alpineclamav3.120.100.1-r0fixed
Alpineclamav3.130.100.1-r0fixed
Alpineclamav3.50.100.1-r0fixed
Alpineclamav3.60.100.1-r0fixed
Alpineclamav3.70.100.1-r0fixed
Alpineclamav3.80.100.1-r0fixed
Alpineclamav3.90.100.1-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianclamavsourcesid0.100.1+dfsg-1not yet assignedNot reportedNot reported
Debianclamavsourceforky0.100.1+dfsg-1not yet assignedNot reportedNot reported
Debianclamavsourcetrixie0.100.1+dfsg-1not yet assignedNot reportedNot reported
Debianclamavsourcebookworm0.100.1+dfsg-1not yet assignedNot reportedNot reported
Ubuntuclamavdeb14.040.100.1+dfsg-1ubuntu0.14.04.1Not reportedUBUNTU-CVE-2018-0360Not reported
Ubuntuclamavdeb16.040.100.1+dfsg-1ubuntu0.16.04.1Not reportedUBUNTU-CVE-2018-0360Not reported
Ubuntuclamavdeb18.040.100.1+dfsg-1ubuntu0.18.04.1Not reportedUBUNTU-CVE-2018-0360Not reported
Ubuntuclamavdeb14.040.100.1+dfsg-1ubuntu0.14.04.1Not reportedUSN-3722-1Not reported
Ubuntuclamavdeb16.040.100.1+dfsg-1ubuntu0.16.04.1Not reportedUSN-3722-1Not reported
Ubuntuclamavdeb18.040.100.1+dfsg-1ubuntu0.18.04.1Not reportedUSN-3722-1Not reported
Suseclamavrpmlinux enterprise server 12 sp2-bcl0.100.1-33.15.2Not reportedSUSE-SU-2018:2323-2Not reported
Suseclamavrpmopenstack cloud 70.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise desktop 12 sp30.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp10.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp20.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise server 12-ltss0.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise server 12 sp1-ltss0.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise server 12 sp2-ltss0.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise server 12 sp30.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp30.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmenterprise storage 40.100.1-33.15.2Not reportedSUSE-SU-2018:2323-1Not reported
Suseclamavrpmlinux enterprise module for basesystem 150.100.1-3.3.1Not reportedSUSE-SU-2018:2230-1Not reported
Suseclamavrpmlinux enterprise point of sale 11 sp30.100.1-0.20.15.1Not reportedSUSE-SU-2018:2232-1Not reported
Suseclamavrpmlinux enterprise server 11 sp3-ltss0.100.1-0.20.15.1Not reportedSUSE-SU-2018:2232-1Not reported
Suseclamavrpmlinux enterprise server 11 sp3-teradata0.100.1-0.20.15.1Not reportedSUSE-SU-2018:2232-1Not reported
Suseclamavrpmlinux enterprise server 11 sp40.100.1-0.20.15.1Not reportedSUSE-SU-2018:2232-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 11 sp40.100.1-0.20.15.1Not reportedSUSE-SU-2018:2232-1Not reported
Alpineclamavapk3.100.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.110.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.120.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.130.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.50.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.60.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.70.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.80.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported
Alpineclamavapk3.90.100.1-r0Not reportedALPINE-CVE-2018-0360Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [clamav]Unknown
    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-base]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-daemon]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-doc]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-docs]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-freshclam]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-milter]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamav-testfiles]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [clamdscan]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [libclamav12]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

  • [libclamav-dev]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · bookworm; dsa · clamav · debian · 12

[Debian 13 (Trixie)]

  • [clamav]Unknown
    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamav-base]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamav-daemon]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamav-doc]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamav-docs]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamav-freshclam]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamav-milter]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamav-testfiles]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

  • [clamdscan]Unknown

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.100.1+dfsg-1

      dsa · clamav · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]