CVE-2018-0202
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated,...
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
CVE-2018-0202- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
CVE-2018-0202- Updated
- 2026-11-02
EUVDEUVD-2018-1025 No score
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
EUVD-2018-1025- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r382-prm5-5rqf
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated,...
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
GHSA-r382-prm5-5rqf- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-0202
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
ALPINE-CVE-2018-0202- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
CVE-2018-0202- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2018-0202
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
DEBIAN-CVE-2018-0202- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-0202
clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.
- Record
UBUNTU-CVE-2018-0202- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0169 No score
Updated clamav packages fix security vulnerabilities
Clamav has been updated to fix 2 security issues and also contains a lot of bugfixes.
Out-of-bounds access in the PDF parser (CVE-2018-0202) Out-of-bounds heap read in XAR parser (CVE-2018-1000085)
- Record
MGASA-2018-0169- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10685-1 No score
clamav-0.103.3-1.4 on GA media
These are all security issues fixed in the clamav-0.103.3-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10685-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0809-1 No score
Security update for clamav
This update for clamav fixes the following issues:
Security issues fixed:
- CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
- CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
- CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
- CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
- CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).
- Record
SUSE-SU-2018:0809-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0863-1 No score
Security update for clamav
This update for clamav fixes the following issues:
Security issues fixed:
- CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
- CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
- CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
- CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
- CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).
- Record
SUSE-SU-2018:0863-1- Updated
- 2026-11-02
OSVUSN-3592-1 No score
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled parsing certain PDF files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-0202)
Hanno Böck discovered that ClamAV incorrectly handled parsing certain XAR files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2018-1000085)
- Record
USN-3592-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clamavAlpine:v3.10 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.11 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.12 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.13 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.4 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.5 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.6 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.7 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.8 |
before 0.99.4-r0 | 0.99.4-r0 |
clamavAlpine:v3.9 |
before 0.99.4-r0 | 0.99.4-r0 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
clamavDebian:12 |
before 0.100.0~beta+dfsg-2 | 0.100.0~beta+dfsg-2 |
clamavDebian:13 |
before 0.100.0~beta+dfsg-2 | 0.100.0~beta+dfsg-2 |
clamavDebian:14 |
before 0.100.0~beta+dfsg-2 | 0.100.0~beta+dfsg-2 |
clamavDebian:7 From an advisory covering 2 CVEs |
before 0.99.4+dfsg-1+deb7u1, plus listed versions 0.97.8+dfsg-10.97.8+dfsg-1+powerpcspe10.98+dfsg-10.98.1+dfsg-10.98.1+dfsg-1+deb7u1 Show 45 moreShow less0.98.1+dfsg-1+deb7u20.98.1+dfsg-1+deb7u30.98.1+dfsg-1+deb7u40.98.1+dfsg-1+squeeze10.98.1+dfsg-20.98.1+dfsg-30.98.1+dfsg-40.98.1+dfsg-50.98.1+dfsg-60.98.3+dfsg-10.98.4+dfsg-0+deb7u10.98.4+dfsg-0+deb7u20.98.4+dfsg-10.98.4+dfsg-20.98.4~rc1+dfsg-10.98.4~rc1+dfsg-20.98.4~rc1+dfsg-30.98.5+dfsg-0+deb7u10.98.5+dfsg-0+deb7u20.98.5+dfsg-0+deb7u30.98.5+dfsg-10.98.5+dfsg-20.98.5+dfsg-30.98.5~beta1+dfsg-10.98.5~beta1+dfsg-20.98.5~beta1+dfsg-30.98.5~rc1+dfsg-10.98.5~rc1+dfsg-20.98.5~rc1+dfsg-30.98.5~rc1+dfsg-40.98.6+dfsg-0+deb7u10.98.6+dfsg-10.98.6+dfsg-20.98.6+dfsg-30.98.7+dfsg-0+deb7u10.98.7+dfsg-10.98.7+dfsg-20.98.7+dfsg-30.98.7+dfsg-40.98.7+dfsg-50.99+dfsg-0+deb7u10.99+dfsg-0+deb7u20.99+dfsg-10.99+dfsg-20.99.1+dfsg-1 |
0.99.4+dfsg-1+deb7u1 |
clamavMageia:6 From an advisory covering 2 CVEs |
before 0.99.4-1.mga6 | 0.99.4-1.mga6 |
clamavSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 5 CVEs |
before 0.99.4-33.9.1 | 0.99.4-33.9.1 |
clamavSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 5 CVEs |
before 0.99.4-33.9.1 | 0.99.4-33.9.1 |
clamavSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 5 CVEs |
before 0.99.4-33.9.1 | 0.99.4-33.9.1 |
clamavSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 5 CVEs |
before 0.99.4-33.9.1 | 0.99.4-33.9.1 |
clamavSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 5 CVEs |
before 0.99.4-33.9.1 | 0.99.4-33.9.1 |
clamavSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 5 CVEs |
before 0.99.4-33.9.1 | 0.99.4-33.9.1 |
clamavSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 5 CVEs |
before 0.99.4-33.9.1 | 0.99.4-33.9.1 |
clamavSUSE:Linux Enterprise Point of Sale 11 SP3 From an advisory covering 5 CVEs |
before 0.99.4-0.20.7.2 | 0.99.4-0.20.7.2 |
clamavSUSE:Linux Enterprise Server 11 SP3-LTSS From an advisory covering 5 CVEs |
before 0.99.4-0.20.7.2 | 0.99.4-0.20.7.2 |
clamavSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 5 CVEs |
before 0.99.4-0.20.7.2 | 0.99.4-0.20.7.2 |
clamavSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 5 CVEs |
before 0.99.4-0.20.7.2 | 0.99.4-0.20.7.2 |
clamavSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 5 CVEs |
before 0.99.4-0.20.7.2 | 0.99.4-0.20.7.2 |
clamavUbuntu:14.04:LTS |
before 0.99.4+addedllvm-0ubuntu0.14.04.1, plus listed versions 0.97.8+dfsg-1ubuntu40.97.8+dfsg-1ubuntu50.98.1+dfsg-1ubuntu40.98.1+dfsg-1ubuntu50.98.1+dfsg-2ubuntu2 Show 8 moreShow less0.98.1+dfsg-4ubuntu10.98.1+dfsg-4ubuntu1.10.98.5+addedllvm-0ubuntu0.14.04.10.98.6+dfsg-0ubuntu0.14.04.10.98.7+dfsg-0ubuntu0.14.04.10.99.2+addedllvm-0ubuntu0.14.04.10.99.2+addedllvm-0ubuntu0.14.04.20.99.3+addedllvm-0ubuntu0.14.04.1 |
0.99.4+addedllvm-0ubuntu0.14.04.1 |
clamavUbuntu:16.04:LTS |
before 0.99.4+addedllvm-0ubuntu0.16.04.1, plus listed versions 0.98.7+dfsg-0ubuntu40.98.7+dfsg-0ubuntu50.99+dfsg-1ubuntu10.99+dfsg-1ubuntu1.10.99+dfsg-1ubuntu1.2 Show 4 moreShow less0.99.2+dfsg-0ubuntu0.16.04.10.99.2+dfsg-0ubuntu0.16.04.20.99.2+dfsg-0ubuntu0.16.04.30.99.3+addedllvm-0ubuntu0.16.04.1 |
0.99.4+addedllvm-0ubuntu0.16.04.1 |
clamavUbuntu:14.04:LTS From an advisory covering 2 CVEs |
before 0.99.4+addedllvm-0ubuntu0.14.04.1, plus listed versions 0.97.8+dfsg-1ubuntu40.97.8+dfsg-1ubuntu50.98.1+dfsg-1ubuntu40.98.1+dfsg-1ubuntu50.98.1+dfsg-2ubuntu2 Show 8 moreShow less0.98.1+dfsg-4ubuntu10.98.1+dfsg-4ubuntu1.10.98.5+addedllvm-0ubuntu0.14.04.10.98.6+dfsg-0ubuntu0.14.04.10.98.7+dfsg-0ubuntu0.14.04.10.99.2+addedllvm-0ubuntu0.14.04.10.99.2+addedllvm-0ubuntu0.14.04.20.99.3+addedllvm-0ubuntu0.14.04.1 |
0.99.4+addedllvm-0ubuntu0.14.04.1 |
clamavUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 0.99.4+addedllvm-0ubuntu0.16.04.1, plus listed versions 0.98.7+dfsg-0ubuntu40.98.7+dfsg-0ubuntu50.99+dfsg-1ubuntu10.99+dfsg-1ubuntu1.10.99+dfsg-1ubuntu1.2 Show 4 moreShow less0.99.2+dfsg-0ubuntu0.16.04.10.99.2+dfsg-0ubuntu0.16.04.20.99.2+dfsg-0ubuntu0.16.04.30.99.3+addedllvm-0ubuntu0.16.04.1 |
0.99.4+addedllvm-0ubuntu0.16.04.1 |
clamavopenSUSE:Tumbleweed From an advisory covering 55 CVEs |
before 0.103.3-1.4 | 0.103.3-1.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | automateforceai/CVE-2018-0202 | 2018-11-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-0202 is a medium vulnerability (CVSS 5.5) in Cisco Clamav, published March 6, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in clamav 0.99.4-r0.
References
usn.ubuntu.com/3592-2
bugzilla.clamav.net/show_bug.cgi?id=11973
lists.debian.org/debian-lts-announce/2018/03/msg00011.html
security.gentoo.org/glsa/201804-16
Show 74 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-0202
github.com/advisories/GHSA-r382-prm5-5rqf
security.alpinelinux.org/vuln/CVE-2018-0202
security-tracker.debian.org/tracker/CVE-2018-0202
advisories.mageia.org/MGASA-2018-0169.html
bugs.mageia.org/show_bug.cgi?id=22737
suse.com/support/update/announcement/2018/suse-su-20180809-1
bugzilla.suse.com/1045315
ubuntu.com/security/CVE-2018-0202
cve.org/CVERecord?id=CVE-2018-0202
Left out here: 19 versions. The JSON record has them.