{"id":"USN-3722-5","aliases":[],"status":"published","title":"clamav regression","description":"USN-3722-1 fixed vulnerabilities in ClamAV. The new package introduced an\nissue which caused dpkg-reconfigure to enter an infinite loop. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that ClamAV incorrectly handled parsing certain HWP\n files. A remote attacker could use this issue to cause ClamAV to hang,\n resulting in a denial of service. (CVE-2018-0360)\n \n It was discovered that ClamAV incorrectly handled parsing certain PDF\n files. A remote attacker could use this issue to cause ClamAV to hang,\n resulting in a denial of service. (CVE-2018-0361)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-09-18T07:11:46Z","modified":"2026-04-22T09:48:26Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"clamav","fixed_in":["0.100.1+dfsg-1ubuntu0.14.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"clamav","fixed_in":["0.100.1+dfsg-1ubuntu0.16.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"clamav","fixed_in":["0.100.1+dfsg-1ubuntu0.18.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.100.1+dfsg-1ubuntu0.14.04.4"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.100.1+dfsg-1ubuntu0.16.04.3"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.100.1+dfsg-1ubuntu0.18.04.3"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-3722-5","tags":["advisory"]},{"url":"https://launchpad.net/bugs/1792051","tags":["report"]}],"sources":{"osv":[{"id":"USN-3722-5","title":"clamav regression","description":"USN-3722-1 fixed vulnerabilities in ClamAV. The new package introduced an\nissue which caused dpkg-reconfigure to enter an infinite loop. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that ClamAV incorrectly handled parsing certain HWP\n files. A remote attacker could use this issue to cause ClamAV to hang,\n resulting in a denial of service. (CVE-2018-0360)\n \n It was discovered that ClamAV incorrectly handled parsing certain PDF\n files. A remote attacker could use this issue to cause ClamAV to hang,\n resulting in a denial of service. (CVE-2018-0361)\n","status":"published","published":"2018-09-18T07:11:46Z","modified":"2026-04-22T09:48:26.744574Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}