CVE-2007-3024: libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary...

Security readout for executives and security teams

Older ClamAV scanners could create temporary files with permissions that were too open. On shared systems, a local user might read sensitive data written by clamd or clamdscan while scanning. The bundle does not support remote exploitation, but exposure matters where untrusted users have local access to affected hosts. Likely limited to legacy systems still running vulnerable ClamAV packages, especially multi-user Unix/Linux hosts or appliances using clamd or clamdscan. Modern supported distributions should already have fixes from 2007-era vendor advisories. Treat this as a legacy hygiene issue, not an emergency, unless affected ClamAV runs on shared systems with local users and sensitive scanned content. Remediate through standard package updates and confirm no obsolete scanner builds remain in production. Mitigation focus: Upgrade ClamAV to 0.90.3 or later, or 0.91rc1 or later.; Apply distribution fixes from Debian, SUSE, Gentoo, Kolab, or your vendor.; Retire unsupported legacy ClamAV builds where vendor fixes are unavailable..

Prepared

Jun 29, 2026, 05:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.