CVE-2016-1371
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service ...
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
- Record
CVE-2016-1371- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
- Record
CVE-2016-1371- Updated
- 2026-11-02
EUVDEUVD-2016-2470 No score
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
- Record
EUVD-2016-2470- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2x5-2j3g-8q37
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service ...
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
- Record
GHSA-x2x5-2j3g-8q37- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
- Record
CVE-2016-1371- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1371
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
- Record
DEBIAN-CVE-2016-1371- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1371
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.
- Record
UBUNTU-CVE-2016-1371- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0402 No score
Updated clamav packages fix security vulnerability
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable (CVE-2016-1371).
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file (CVE-2016-1372).
libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document (CVE-2016-1405).
The clavav package has been updated to version 0.99.2, fixing these issues and other bugs. See the upstream release announcements for details.
- Record
MGASA-2016-0402- Updated
- 2026-11-02
OSVUSN-3093-1 No score
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled certain malformed files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.
In the default installation, attackers would be isolated by the ClamAV AppArmor profile.
- Record
USN-3093-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clamavDebian:12 |
before 0.99.2+dfsg-1 | 0.99.2+dfsg-1 |
clamavDebian:13 |
before 0.99.2+dfsg-1 | 0.99.2+dfsg-1 |
clamavDebian:14 |
before 0.99.2+dfsg-1 | 0.99.2+dfsg-1 |
clamavDebian:7 From an advisory covering 2 CVEs |
before 0.99.2+dfsg-0+deb7u2, plus listed versions 0.97.8+dfsg-10.97.8+dfsg-1+powerpcspe10.98+dfsg-10.98.1+dfsg-10.98.1+dfsg-1+deb7u1 Show 45 moreShow less0.98.1+dfsg-1+deb7u20.98.1+dfsg-1+deb7u30.98.1+dfsg-1+deb7u40.98.1+dfsg-1+squeeze10.98.1+dfsg-20.98.1+dfsg-30.98.1+dfsg-40.98.1+dfsg-50.98.1+dfsg-60.98.3+dfsg-10.98.4+dfsg-0+deb7u10.98.4+dfsg-0+deb7u20.98.4+dfsg-10.98.4+dfsg-20.98.4~rc1+dfsg-10.98.4~rc1+dfsg-20.98.4~rc1+dfsg-30.98.5+dfsg-0+deb7u10.98.5+dfsg-0+deb7u20.98.5+dfsg-0+deb7u30.98.5+dfsg-10.98.5+dfsg-20.98.5+dfsg-30.98.5~beta1+dfsg-10.98.5~beta1+dfsg-20.98.5~beta1+dfsg-30.98.5~rc1+dfsg-10.98.5~rc1+dfsg-20.98.5~rc1+dfsg-30.98.5~rc1+dfsg-40.98.6+dfsg-0+deb7u10.98.6+dfsg-10.98.6+dfsg-20.98.6+dfsg-30.98.7+dfsg-0+deb7u10.98.7+dfsg-10.98.7+dfsg-20.98.7+dfsg-30.98.7+dfsg-40.98.7+dfsg-50.99+dfsg-0+deb7u10.99+dfsg-0+deb7u20.99+dfsg-10.99+dfsg-20.99.1+dfsg-1 |
0.99.2+dfsg-0+deb7u2 |
clamavMageia:5 From an advisory covering 3 CVEs |
before 0.99.2-1.mga5 | 0.99.2-1.mga5 |
clamavUbuntu:14.04:LTS |
before 0.99.2+addedllvm-0ubuntu0.14.04.1, plus listed versions 0.97.8+dfsg-1ubuntu40.97.8+dfsg-1ubuntu50.98.1+dfsg-1ubuntu40.98.1+dfsg-1ubuntu50.98.1+dfsg-2ubuntu2 Show 5 moreShow less0.98.1+dfsg-4ubuntu10.98.1+dfsg-4ubuntu1.10.98.5+addedllvm-0ubuntu0.14.04.10.98.6+dfsg-0ubuntu0.14.04.10.98.7+dfsg-0ubuntu0.14.04.1 |
0.99.2+addedllvm-0ubuntu0.14.04.1 |
clamavUbuntu:16.04:LTS |
before 0.99.2+dfsg-0ubuntu0.16.04.1, plus listed versions 0.98.7+dfsg-0ubuntu40.98.7+dfsg-0ubuntu50.99+dfsg-1ubuntu10.99+dfsg-1ubuntu1.10.99+dfsg-1ubuntu1.2 |
0.99.2+dfsg-0ubuntu0.16.04.1 |
clamavUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 0.99.2+addedllvm-0ubuntu0.14.04.1, plus listed versions 0.97.8+dfsg-1ubuntu40.97.8+dfsg-1ubuntu50.98.1+dfsg-1ubuntu40.98.1+dfsg-1ubuntu50.98.1+dfsg-2ubuntu2 Show 5 moreShow less0.98.1+dfsg-4ubuntu10.98.1+dfsg-4ubuntu1.10.98.5+addedllvm-0ubuntu0.14.04.10.98.6+dfsg-0ubuntu0.14.04.10.98.7+dfsg-0ubuntu0.14.04.1 |
0.99.2+addedllvm-0ubuntu0.14.04.1 |
clamavUbuntu:16.04:LTS From an advisory covering 3 CVEs |
before 0.99.2+dfsg-0ubuntu0.16.04.1, plus listed versions 0.98.7+dfsg-0ubuntu40.98.7+dfsg-0ubuntu50.99+dfsg-1ubuntu10.99+dfsg-1ubuntu1.10.99+dfsg-1ubuntu1.2 |
0.99.2+dfsg-0ubuntu0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1371 is a medium vulnerability (CVSS 5.5) in Clamav, published June 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in clamav 0.99.2+dfsg-1.
References
blog.clamav.net/2016/05/clamav-0992-has-been-released.html
foxglovesecurity.com/2016/06/13/finding-pearls-fuzzing-clamav
bugzilla.clamav.net/show_bug.cgi?id=11514
ubuntu.com/usn/USN-3093-1
securityfocus.com/bid/93222
nvd.nist.gov/vuln/detail/CVE-2016-1371
Show 10 moreShow less
github.com/advisories/GHSA-x2x5-2j3g-8q37
security-tracker.debian.org/tracker/CVE-2016-1371
advisories.mageia.org/MGASA-2016-0402.html
bugs.mageia.org/show_bug.cgi?id=19495
ubuntu.com/security/CVE-2016-1371
cve.org/CVERecord?id=CVE-2016-1371
Left out here: 3 versions. The JSON record has them.