Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values. This vulnerability is addressed in the following product release:
Clam Anti-Virus, ClamAV, 0.88.4
Publication date: Thu, 18 Oct 2018 02:32:00 +0000