CVE-2006-1989

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-05-01 · updated 2026-06-16

Description

Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.

Affected products

Clam Anti-Virus Clamav: 0.88, 0.88.1

References

http://kolab.org/security/kolab-vendor-notice-09.txt
http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
http://secunia.com/advisories/19874
http://secunia.com/advisories/19880
http://secunia.com/advisories/19912
http://secunia.com/advisories/19963
http://secunia.com/advisories/19964
http://secunia.com/advisories/20117
http://secunia.com/advisories/20159
http://secunia.com/advisories/20877
http://securitytracker.com/id?1016392

Get alerted when CVE-2006-1989 or the next vulnerability affects your stack