Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2012-1459

Medium

The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!

Published Mar 21, 2012 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2012-1459

Key Facts

Patch immediately
  • CVE-2012-1459 is a medium-severity vulnerability (CVSS 4.3 v2) affecting V3 Internet Security (Ahnlab), Avast Antivirus (Alwil), Vba32 (Anti-Virus) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 100% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Clamav 0.97.5+dfsg-1, Clamav 0.99.2-4.1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v2

4.3

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS (30-day exploit likelihood)

100%

Higher than 99.9% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2012-1459 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.

Affected Products

47 affected entries in total
ProductAffected versionsFixed in
V3 Internet SecurityAhnlab2011.01.18.00n/a
Avast AntivirusAlwil4.8.1351.0, 5.0.677.0n/a
Vba32Anti-Virus3.12.14.2n/a
Avl SdkAntiy2.0.3.7n/a
Command AntivirusAuthentium5.2.11.5n/a
20 more affected products in the full CVE brief

Patched Releases

Clamav

0.97.5+dfsg-1, 0.99.2-4.1

Timeline

  1. Publicly disclosed

    Mar 21, 2012

  2. Last updated

    Aug 4, 2026

Weakness Type

  • CWE-264

References

13 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2012-1459 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo