CVE-2008-2713
Description
libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An out-of-bounds read in ClamAV's libclamav/petite.c allows remote attackers to cause a denial of service via crafted Petite files.
Vulnerability
An out-of-bounds read vulnerability exists in the libclamav/petite.c file of ClamAV before version 0.93.1. The bug occurs when processing a crafted Petite compressed file, allowing an attacker to trigger a read beyond the bounds of an allocated array [4]. This issue was reported by Damian Put and is tracked as bug #1000 in the ClamAV Bugzilla [4].
Exploitation
To exploit this vulnerability, an attacker must send a specially crafted Petite file to the ClamAV scanning engine. The attack requires the ClamAV service to be actively scanning incoming files (e.g., email attachments or web content). The vulnerable code path is triggered automatically when the scanner attempts to decompress the malicious Petite file. No authentication or special privileges are required beyond the ability to deliver the file to the scanner [1][4].
Impact
Successful exploitation leads to an out-of-bounds memory read, which can cause the ClamAV process (e.g., clamd) to crash, resulting in a denial of service. This prevents further scanning of files until the service is restarted. The vulnerability does not appear to allow code execution or privilege escalation [3][4].
Mitigation
The vulnerability is fixed in ClamAV version 0.93.1, which was released on June 16, 2008 [4]. Users should update to this version or later. No workaround is available for versions prior to the fix. The vulnerability has been assigned CVE-2008-2713 [4]. Systems running ClamAV should apply the update as soon as possible to prevent denial-of-service attacks.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
58cpe:2.3:a:clam_anti-virus:clamav:0.15:*:*:*:*:*:*:*+ 56 more
- cpe:2.3:a:clam_anti-virus:clamav:0.15:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.20:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.21:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.22:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.23:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.24:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.51:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.52:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.53:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.54:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.60:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.60p:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.65:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.67:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.68:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.68.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.70:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.71:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.72:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.73:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.74:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.75:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.75.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.80:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.80_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.80_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.80_rc3:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.80_rc4:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.81:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.81_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.82:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.83:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.84:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.84_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.84_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.85:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.85.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.86:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.86.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.86.2:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.86_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.87:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.87.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.88:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.88.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.88.3:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.88.4:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.88.5:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.88.6:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.88.7:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.90:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.90.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.90.2:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.90rc1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.90_rc1.1:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.90_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:clam_anti-virus:clamav:0.90_rc3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
31- svn.clamav.net/websvn/diff.phpnvdExploit
- www.us-cert.gov/cas/techalerts/TA08-260A.htmlnvdUS Government Resource
- kolab.org/security/kolab-vendor-notice-21.txtnvd
- lists.apple.com/archives/security-announce//2008/Sep/msg00005.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.htmlnvd
- secunia.com/advisories/30657nvd
- secunia.com/advisories/30785nvd
- secunia.com/advisories/30829nvd
- secunia.com/advisories/30967nvd
- secunia.com/advisories/31091nvd
- secunia.com/advisories/31167nvd
- secunia.com/advisories/31206nvd
- secunia.com/advisories/31437nvd
- secunia.com/advisories/31576nvd
- secunia.com/advisories/31882nvd
- security.gentoo.org/glsa/glsa-200808-07.xmlnvd
- sourceforge.net/project/shownotes.phpnvd
- up2date.astaro.com/2008/08/up2date_asg_v7300_ga_released.htmlnvd
- www.debian.org/security/2008/dsa-1616nvd
- www.mandriva.com/security/advisoriesnvd
- www.openwall.com/lists/oss-security/2008/06/15/2nvd
- www.openwall.com/lists/oss-security/2008/06/17/8nvd
- www.securityfocus.com/bid/29750nvd
- www.securitytracker.com/idnvd
- www.vupen.com/english/advisories/2008/1855/referencesnvd
- www.vupen.com/english/advisories/2008/2584nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/43133nvd
- www.redhat.com/archives/fedora-package-announce/2008-July/msg00617.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2008-June/msg00763.htmlnvd
- wwws.clamav.net/bugzilla/show_bug.cginvd
News mentions
0No linked articles in our index yet.