p PatchFirst

CVE-2020-37167

CVE-2020-37167 · ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

CVSS 8.6 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • clambc

    Versions
    • ≥ 0, < 0.103.0-rc: Affected (semver)

    Update to 0.103.0-rc

  • clamav Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.103.0+dfsg-1

    Update to 0.103.0+dfsg-1

  • clamav Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.103.0+dfsg-1

    Update to 0.103.0+dfsg-1

  • clamav Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.103.0+dfsg-1

    Update to 0.103.0+dfsg-1

Original sources

Check your server →