Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read. Per http://www.ubuntu.com/usn/USN-1816-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS"
Publication date: Tue, 14 May 2013 04:55:00 +0000