CVE-2016-1372
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service ...
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
- Record
CVE-2016-1372- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
- Record
CVE-2016-1372- Updated
- 2026-11-02
EUVDEUVD-2016-2471 No score
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
- Record
EUVD-2016-2471- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-87jf-wcch-mpm4
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service ...
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
- Record
GHSA-87jf-wcch-mpm4- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
- Record
CVE-2016-1372- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1372
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
- Record
DEBIAN-CVE-2016-1372- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-1372
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.
- Record
UBUNTU-CVE-2016-1372- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0402 No score
Updated clamav packages fix security vulnerability
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable (CVE-2016-1371).
ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file (CVE-2016-1372).
libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041, allows remote attackers to cause a denial of service (AMP process restart) via a crafted document (CVE-2016-1405).
The clavav package has been updated to version 0.99.2, fixing these issues and other bugs. See the upstream release announcements for details.
- Record
MGASA-2016-0402- Updated
- 2026-11-02
OSVSUSE-SU-2018:0464-1 No score
Security update for p7zip
This update for p7zip fixes the following issues:
Security issues fixed:
- CVE-2016-1372: Fixed multiple vulnerabilities when processing crafted 7z files (bsc#984650)
- CVE-2017-17969: Fixed a heap-based buffer overflow in a shrink decoder (bsc#1077725)
- CVE-2018-5996: Fixed memory corruption in RAR decompression. The complete RAR decoder was removed as it also has license issues (bsc#1077724 bsc#1077978)
- Record
SUSE-SU-2018:0464-1- Updated
- 2026-11-02
OSVUSN-3093-1 No score
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled certain malformed files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.
In the default installation, attackers would be isolated by the ClamAV AppArmor profile.
- Record
USN-3093-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clamavDebian:12 |
before 0.99.2+dfsg-1 | 0.99.2+dfsg-1 |
clamavDebian:13 |
before 0.99.2+dfsg-1 | 0.99.2+dfsg-1 |
clamavDebian:14 |
before 0.99.2+dfsg-1 | 0.99.2+dfsg-1 |
clamavDebian:7 From an advisory covering 2 CVEs |
before 0.99.2+dfsg-0+deb7u2, plus listed versions 0.97.8+dfsg-10.97.8+dfsg-1+powerpcspe10.98+dfsg-10.98.1+dfsg-10.98.1+dfsg-1+deb7u1 Show 45 moreShow less0.98.1+dfsg-1+deb7u20.98.1+dfsg-1+deb7u30.98.1+dfsg-1+deb7u40.98.1+dfsg-1+squeeze10.98.1+dfsg-20.98.1+dfsg-30.98.1+dfsg-40.98.1+dfsg-50.98.1+dfsg-60.98.3+dfsg-10.98.4+dfsg-0+deb7u10.98.4+dfsg-0+deb7u20.98.4+dfsg-10.98.4+dfsg-20.98.4~rc1+dfsg-10.98.4~rc1+dfsg-20.98.4~rc1+dfsg-30.98.5+dfsg-0+deb7u10.98.5+dfsg-0+deb7u20.98.5+dfsg-0+deb7u30.98.5+dfsg-10.98.5+dfsg-20.98.5+dfsg-30.98.5~beta1+dfsg-10.98.5~beta1+dfsg-20.98.5~beta1+dfsg-30.98.5~rc1+dfsg-10.98.5~rc1+dfsg-20.98.5~rc1+dfsg-30.98.5~rc1+dfsg-40.98.6+dfsg-0+deb7u10.98.6+dfsg-10.98.6+dfsg-20.98.6+dfsg-30.98.7+dfsg-0+deb7u10.98.7+dfsg-10.98.7+dfsg-20.98.7+dfsg-30.98.7+dfsg-40.98.7+dfsg-50.99+dfsg-0+deb7u10.99+dfsg-0+deb7u20.99+dfsg-10.99+dfsg-20.99.1+dfsg-1 |
0.99.2+dfsg-0+deb7u2 |
clamavMageia:5 From an advisory covering 3 CVEs |
before 0.99.2-1.mga5 | 0.99.2-1.mga5 |
p7zipSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 3 CVEs |
before 9.20.1-7.3.1 | 9.20.1-7.3.1 |
p7zipSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 3 CVEs |
before 9.20.1-7.3.1 | 9.20.1-7.3.1 |
p7zipSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 3 CVEs |
before 9.20.1-7.3.1 | 9.20.1-7.3.1 |
p7zipSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 3 CVEs |
before 9.20.1-7.3.1 | 9.20.1-7.3.1 |
p7zipSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 3 CVEs |
before 9.20.1-7.3.1 | 9.20.1-7.3.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
p7zipSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 3 CVEs |
before 9.20.1-7.3.1 | 9.20.1-7.3.1 |
p7zipSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 3 CVEs |
before 9.20.1-7.3.1 | 9.20.1-7.3.1 |
clamavUbuntu:14.04:LTS |
before 0.99.2+addedllvm-0ubuntu0.14.04.1, plus listed versions 0.97.8+dfsg-1ubuntu40.97.8+dfsg-1ubuntu50.98.1+dfsg-1ubuntu40.98.1+dfsg-1ubuntu50.98.1+dfsg-2ubuntu2 Show 5 moreShow less0.98.1+dfsg-4ubuntu10.98.1+dfsg-4ubuntu1.10.98.5+addedllvm-0ubuntu0.14.04.10.98.6+dfsg-0ubuntu0.14.04.10.98.7+dfsg-0ubuntu0.14.04.1 |
0.99.2+addedllvm-0ubuntu0.14.04.1 |
clamavUbuntu:16.04:LTS |
before 0.99.2+dfsg-0ubuntu0.16.04.1, plus listed versions 0.98.7+dfsg-0ubuntu40.98.7+dfsg-0ubuntu50.99+dfsg-1ubuntu10.99+dfsg-1ubuntu1.10.99+dfsg-1ubuntu1.2 |
0.99.2+dfsg-0ubuntu0.16.04.1 |
clamavUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 0.99.2+addedllvm-0ubuntu0.14.04.1, plus listed versions 0.97.8+dfsg-1ubuntu40.97.8+dfsg-1ubuntu50.98.1+dfsg-1ubuntu40.98.1+dfsg-1ubuntu50.98.1+dfsg-2ubuntu2 Show 5 moreShow less0.98.1+dfsg-4ubuntu10.98.1+dfsg-4ubuntu1.10.98.5+addedllvm-0ubuntu0.14.04.10.98.6+dfsg-0ubuntu0.14.04.10.98.7+dfsg-0ubuntu0.14.04.1 |
0.99.2+addedllvm-0ubuntu0.14.04.1 |
clamavUbuntu:16.04:LTS From an advisory covering 3 CVEs |
before 0.99.2+dfsg-0ubuntu0.16.04.1, plus listed versions 0.98.7+dfsg-0ubuntu40.98.7+dfsg-0ubuntu50.99+dfsg-1ubuntu10.99+dfsg-1ubuntu1.10.99+dfsg-1ubuntu1.2 |
0.99.2+dfsg-0ubuntu0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1372 is a medium vulnerability (CVSS 5.5) in Clamav, published June 14, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in clamav 0.99.2+dfsg-1.
References
blog.clamav.net/2016/05/clamav-0992-has-been-released.html
foxglovesecurity.com/2016/06/13/finding-pearls-fuzzing-clamav
securityfocus.com/bid/93221
bugzilla.clamav.net/show_bug.cgi?id=11514
ubuntu.com/usn/USN-3093-1
nvd.nist.gov/vuln/detail/CVE-2016-1372
Show 18 moreShow less
github.com/advisories/GHSA-87jf-wcch-mpm4
security-tracker.debian.org/tracker/CVE-2016-1372
advisories.mageia.org/MGASA-2016-0402.html
bugs.mageia.org/show_bug.cgi?id=19495
suse.com/support/update/announcement/2018/suse-su-20180464-1
bugzilla.suse.com/1077724
ubuntu.com/security/CVE-2016-1372
cve.org/CVERecord?id=CVE-2016-1372
Left out here: 3 versions. The JSON record has them.