CVE-2007-0897
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions,...
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
- Record
CVE-2007-0897- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-772
- Updated
- 2026-11-02
CVE List No score
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
- Record
CVE-2007-0897- Updated
- 2026-11-02
EUVDEUVD-2007-0893 No score
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
- Record
EUVD-2007-0893- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3ppm-vmgq-rr54
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions,...
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
- Record
GHSA-3ppm-vmgq-rr54- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
OSV
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
- Record
CVE-2007-0897- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-0897
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
- Record
DEBIAN-CVE-2007-0897- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10685-1 No score
clamav-0.103.3-1.4 on GA media
These are all security issues fixed in the clamav-0.103.3-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10685-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clamavDebian:12 |
before 0.90-1 | 0.90-1 |
clamavDebian:13 |
before 0.90-1 | 0.90-1 |
clamavDebian:14 |
before 0.90-1 | 0.90-1 |
clamavDebian:3.1 From an advisory covering 3 CVEs |
before 0.84-2.sarge.15, plus listed versions 0.84-20.84-2.sarge.10.84-2.sarge.100.84-2.sarge.110.84-2.sarge.12 Show 10 moreShow less0.84-2.sarge.130.84-2.sarge.140.84-2.sarge.20.84-2.sarge.30.84-2.sarge.40.84-2.sarge.50.84-2.sarge.60.84-2.sarge.70.84-2.sarge.80.84-2.sarge.9 |
0.84-2.sarge.15 |
clamavopenSUSE:Tumbleweed From an advisory covering 55 CVEs |
before 0.103.3-1.4 | 0.103.3-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0897 is a high vulnerability (CVSS 7.5) in Clamav, published February 16, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.50%, the 89th percentile. Fixed in clamav 0.90-1.
References
securityfocus.com/bid/22580
exchange.xforce.ibmcloud.com/vulnerabilities/32531
secunia.com/advisories/24187
vupen.com/english/advisories/2008/0924/references
osvdb.org/32283
Show 72 moreShow less
debian.org/security/2007/dsa-1263
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
lists.suse.com/archive/suse-security-announce/2007-Feb/0004.html
security.gentoo.org/glsa/glsa-200703-03.xml
mandriva.com/security/advisories?name=MDKSA-2007:043
labs.idefense.com/intelligence/vulnerabilities/display.php?id=475
docs.info.apple.com/article.html?artnum=307562
securitytracker.com/id?1017659
nvd.nist.gov/vuln/detail/CVE-2007-0897
github.com/advisories/GHSA-3ppm-vmgq-rr54
security-tracker.debian.org/tracker/CVE-2007-0897
suse.com/security/cve/CVE-2005-3239