CVE-2006-1615
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88...
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
Exploit likelihood
What each source reports
NVD Score used
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
- Record
CVE-2006-1615- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
- Record
CVE-2006-1615- Updated
- 2026-11-02
EUVDEUVD-2006-1616 No score
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
- Record
EUVD-2006-1616- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x32g-rfqc-j2m7 No score
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88...
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
- Record
GHSA-x32g-rfqc-j2m7- Weakness
- CWE-134
- Updated
- 2026-11-02
OSV No score
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
- Record
CVE-2006-1615- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-1615 No score
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
- Record
DEBIAN-CVE-2006-1615- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clamavDebian:12 |
before 0.88.1-1 | 0.88.1-1 |
clamavDebian:13 |
before 0.88.1-1 | 0.88.1-1 |
clamavDebian:14 |
before 0.88.1-1 | 0.88.1-1 |
clamavDebian:3.1 From an advisory covering 3 CVEs |
before 0.84-2.sarge.8, plus listed versions 0.84-20.84-2.sarge.10.84-2.sarge.20.84-2.sarge.30.84-2.sarge.40.84-2.sarge.50.84-2.sarge.60.84-2.sarge.7 |
0.84-2.sarge.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1615 is a high vulnerability (CVSS 10.0) in Clamav, published April 5, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.6%, the 96th percentile. Fixed in clamav 0.88.1-1.
References
secunia.com/advisories/19567
securityfocus.com/bid/17951
vupen.com/english/advisories/2006/1258
us-cert.gov/cas/techalerts/TA06-132A.html
sourceforge.net/project/shownotes.php?release_id=407078&group_id=86638
Show 20 moreShow less
osvdb.org/24458
up2date.astaro.com/2006/05/low_up2date_6202.html
gentoo.org/security/en/glsa/glsa-200604-06.xml
lists.apple.com/archives/security-announce/2006/May/msg00003.html
lists.suse.com/archive/suse-security-announce/2006-Apr/0002.html
mandriva.com/security/advisories?name=MDKSA-2006:067
debian.org/security/2006/dsa-1024
exchange.xforce.ibmcloud.com/vulnerabilities/25661
trustix.org/errata/2006/0020
nvd.nist.gov/vuln/detail/CVE-2006-1615
github.com/advisories/GHSA-x32g-rfqc-j2m7
security-tracker.debian.org/tracker/CVE-2006-1615