CVE-2012-3501
25.08.2012, 10:29
The squidclamav_check_preview_handler function in squidclamav.c in SquidClamav 5.x before 5.8 and 6.x before 6.7 passes an unescaped URL to a system command call, which allows remote attackers to cause a denial of service (daemon crash) via a URL with certain characters, as demonstrated using %0D or %0A.Enginsight
| Vendor | Product | Version |
|---|---|---|
| darold | squidclamav | 5.0 |
| darold | squidclamav | 5.1 |
| darold | squidclamav | 5.2 |
| darold | squidclamav | 5.3 |
| darold | squidclamav | 5.4 |
| darold | squidclamav | 5.5 |
| darold | squidclamav | 5.6 |
| darold | squidclamav | 5.7 |
| darold | squidclamav | 6.0 |
| darold | squidclamav | 6.1 |
| darold | squidclamav | 6.2 |
| darold | squidclamav | 6.3 |
| darold | squidclamav | 6.4 |
| darold | squidclamav | 6.5 |
| darold | squidclamav | 6.6 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
References