CVE-2011-1003

Double free vulnerability in the vba_read_project_strings function in vba_extract.c in libclamav in ClamAV before 0.97 might allow remote attackers to execute arbitrary code via crafted Visual Basic for Applications (VBA) data in a Microsoft Office document. NOTE: some of these details are obtained from third party information.

• CWE-399

• https://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob%3Bf=ChangeLog%3Bhb=clamav-0.97
• https://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=commit%3Bh=d21fb8d975f8c9688894a8cef4d50d977022e09f
• https://lists.fedoraproject.org/pipermail/package-announce/2011-March/055771.html
• https://lists.fedoraproject.org/pipermail/package-announce/2011-March/055777.html
• https://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
• https://openwall.com/lists/oss-security/2011/02/21/1
• https://openwall.com/lists/oss-security/2011/02/21/4
• https://osvdb.org/70937
• https://secunia.com/advisories/43392Vendor Advisory
• https://secunia.com/advisories/43498
• https://secunia.com/advisories/43752
• https://securitytracker.com/id?1025100
• https://www.mandriva.com/en/support/security/advisories/?name=MDVA-2011:007
• https://www.securityfocus.com/bid/46470
• https://www.ubuntu.com/usn/USN-1076-1
• https://www.vupen.com/english/advisories/2011/0453Vendor Advisory
• https://www.vupen.com/english/advisories/2011/0458Vendor Advisory
• https://www.vupen.com/english/advisories/2011/0523
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65544
• https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2486
• https://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob%3Bf=ChangeLog%3Bhb=clamav-0.97
• https://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=commit%3Bh=d21fb8d975f8c9688894a8cef4d50d977022e09f
• https://lists.fedoraproject.org/pipermail/package-announce/2011-March/055771.html
• https://lists.fedoraproject.org/pipermail/package-announce/2011-March/055777.html
• https://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
• https://openwall.com/lists/oss-security/2011/02/21/1
• https://openwall.com/lists/oss-security/2011/02/21/4
• https://osvdb.org/70937
• https://secunia.com/advisories/43392Vendor Advisory
• https://secunia.com/advisories/43498
• https://secunia.com/advisories/43752
• https://securitytracker.com/id?1025100
• https://www.mandriva.com/en/support/security/advisories/?name=MDVA-2011:007
• https://www.securityfocus.com/bid/46470
• https://www.ubuntu.com/usn/USN-1076-1
• https://www.vupen.com/english/advisories/2011/0453Vendor Advisory
• https://www.vupen.com/english/advisories/2011/0458Vendor Advisory
• https://www.vupen.com/english/advisories/2011/0523
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65544
• https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2486

Published

Feb 23, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-10024MJM Core Player (likely now referred to as MJM Player) 2011 …8.4
• CVE-2011-10025Subtitle Processor 7.7.1 contains a buffer overflow vulnerab…8.5
• CVE-2011-10026Spreecommerce versions prior to 0.50.x contain a remote comm…9.8
• CVE-2011-10027AOL Desktop 9.6 contains a buffer overflow vulnerability in …8.4
• CVE-2011-10028The RealNetworks RealArcade platform includes an ActiveX con…8.7
• CVE-2011-10029Solar FTP Server fails to properly handle format strings pas…8.7
• CVE-2011-10030Foxit PDF Reader <  4.3.1.0218 exposes a JavaScript API func…8.4
• CVE-2011-10031Rejected reason: This CVE has the been REJECTED and will not…
• CVE-2011-10032Sunway ForceControl version 6.1 SP3 and earlier contains a s…9.3
• CVE-2011-10033The WordPress plugin is-human <= v1.4.2 contains an eval inj…9.3
• CVE-2011-10034AUTOMGEN versions up to and including 8.0.0.7 (also referenc…6.9
• CVE-2011-10035Nagios XI versions prior to 2011R1.9 contain privilege escal…7