p PatchFirst

CVE-2023-20032

CVE-2023-20032

This page contains facts from public vulnerability sources. Check the original advisory before updating.

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"].

CVSS 9.8 · Critical · EPSS 30.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • cisco secure web appliance

    Versions
    • 11.7.0-406: Affected
    • 11.7.0-418: Affected
    • 11.7.1-049: Affected
    • 11.7.1-006: Affected
    • 11.7.1-020: Affected
    • 11.7.2-011: Affected
    • 11.8.0-414: Affected
    • 11.8.1-023: Affected
    • 11.8.3-018: Affected
    • 11.8.3-021: Affected
    • 12.0.1-268: Affected
    • 12.0.3-007: Affected
    • 12.5.2-007: Affected
    • 12.5.1-011: Affected
    • 12.5.4-005: Affected
    • 12.5.5-004: Affected
    • 14.5.0-498: Affected
    • 14.0.3-014: Affected
    • 14.0.2-012: Affected

    No fix published

  • cisco secure endpoint

    Versions
    • 6.1.9: Affected
    • 6.2.5: Affected
    • 6.3.7: Affected
    • 6.3.3: Affected
    • 7.0.5: Affected
    • 7.1.1: Affected
    • 1.12.1: Affected
    • 1.12.2: Affected
    • 1.12.3: Affected
    • 1.12.7: Affected
    • 1.12.4: Affected
    • 1.11.0: Affected
    • 1.10.2: Affected
    • 1.10.0: Affected
    • 1.14.0: Affected
    • 1.6.0: Affected
    • 1.9.0: Affected
    • 1.8.1: Affected
    • 1.8.0: Affected
    • 1.7.0: Affected
    • 7.2.13: Affected
    • 7.3.5: Affected

    No fix published

  • cisco secure endpoint private cloud administration portal

    Versions
    • N/A: Affected

    No fix published

  • clamav Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.0.1+dfsg-1

    Update to 1.0.1+dfsg-1

  • clamav Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.0.1+dfsg-1

    Update to 1.0.1+dfsg-1

  • clamav Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.0.1+dfsg-1

    Update to 1.0.1+dfsg-1

  • clamav Ubuntu:Pro:14.04:LTS

    Versions
    • 0.97.8+dfsg-1ubuntu4
    • 0.97.8+dfsg-1ubuntu5
    • 0.98.1+dfsg-1ubuntu4
    • 0.98.1+dfsg-1ubuntu5
    • 0.98.1+dfsg-2ubuntu2
    • 0.98.1+dfsg-4ubuntu1
    • 0.98.1+dfsg-4ubuntu1.1
    • 0.98.5+addedllvm-0ubuntu0.14.04.1
    • 0.98.6+dfsg-0ubuntu0.14.04.1
    • 0.98.7+dfsg-0ubuntu0.14.04.1
    • 0.99.2+addedllvm-0ubuntu0.14.04.1
    • 0.99.2+addedllvm-0ubuntu0.14.04.2
    • 0.99.3+addedllvm-0ubuntu0.14.04.1
    • 0.99.4+addedllvm-0ubuntu0.14.04.1
    • 0.100.1+dfsg-1ubuntu0.14.04.1
    • 0.100.1+dfsg-1ubuntu0.14.04.2
    • 0.100.1+dfsg-1ubuntu0.14.04.3
    • 0.100.1+dfsg-1ubuntu0.14.04.4
    • 0.100.2+dfsg-1ubuntu0.14.04.1
    • 0.100.2+dfsg-1ubuntu0.14.04.2
    • 0.100.3+dfsg-0ubuntu0.14.04.1
    • 0.100.3+dfsg-0ubuntu0.14.04.1+esm1
    • 0.101.4+dfsg-0ubuntu0.14.04.1+esm1
    • 0.102.1+dfsg-0ubuntu0.14.04.1+esm1
    • 0.102.2+dfsg-0ubuntu0.14.04.1+esm1
    • 0.102.3+dfsg-0ubuntu0.14.04.1+esm1
    • 0.102.4+dfsg-0ubuntu0.14.04.1+esm1
    • 0.103.2+dfsg-0ubuntu0.14.04.1+esm1
    • 0.103.2+dfsg-0ubuntu0.14.04.1+esm2
    • 0.103.5+dfsg-0ubuntu0.14.04.1+esm1
    • 0.103.6+dfsg-0ubuntu0.14.04.1+esm1
    Affected ranges
    • ECOSYSTEM: < 0.103.8+dfsg-0ubuntu0.14.04.1+esm1

    Update to 0.103.8+dfsg-0ubuntu0.14.04.1+esm1

  • clamav Ubuntu:Pro:16.04:LTS

    Versions
    • 0.98.7+dfsg-0ubuntu4
    • 0.98.7+dfsg-0ubuntu5
    • 0.99+dfsg-1ubuntu1
    • 0.99+dfsg-1ubuntu1.1
    • 0.99+dfsg-1ubuntu1.2
    • 0.99.2+dfsg-0ubuntu0.16.04.1
    • 0.99.2+dfsg-0ubuntu0.16.04.2
    • 0.99.2+dfsg-0ubuntu0.16.04.3
    • 0.99.3+addedllvm-0ubuntu0.16.04.1
    • 0.99.4+addedllvm-0ubuntu0.16.04.1
    • 0.100.1+dfsg-1ubuntu0.16.04.1
    • 0.100.1+dfsg-1ubuntu0.16.04.2
    • 0.100.1+dfsg-1ubuntu0.16.04.3
    • 0.100.2+dfsg-1ubuntu0.16.04.1
    • 0.100.3+dfsg-0ubuntu0.16.04.1
    • 0.101.4+dfsg-0ubuntu0.16.04.1
    • 0.102.1+dfsg-0ubuntu0.16.04.2
    • 0.102.2+dfsg-0ubuntu0.16.04.1
    • 0.102.3+dfsg-0ubuntu0.16.04.1
    • 0.102.4+dfsg-0ubuntu0.16.04.1
    • 0.103.2+dfsg-0ubuntu0.16.04.1
    • 0.103.2+dfsg-0ubuntu0.16.04.1+esm1
    • 0.103.5+dfsg-0ubuntu0.16.04.1+esm1
    • 0.103.6+dfsg-0ubuntu0.16.04.1+esm1
    Affected ranges
    • ECOSYSTEM: < 0.103.8+dfsg-0ubuntu0.16.04.1+esm1

    Update to 0.103.8+dfsg-0ubuntu0.16.04.1+esm1

  • clamav Ubuntu:18.04:LTS

    Versions
    • 0.99.2+dfsg-6ubuntu2
    • 0.99.3~beta1+dfsg-2ubuntu1
    • 0.99.3~beta1+dfsg-2ubuntu2
    • 0.99.3+addedllvm-0ubuntu1
    • 0.99.3+addedllvm-0ubuntu2
    • 0.99.4+addedllvm-0ubuntu1
    • 0.100.1+dfsg-1ubuntu0.18.04.1
    • 0.100.1+dfsg-1ubuntu0.18.04.2
    • 0.100.1+dfsg-1ubuntu0.18.04.3
    • 0.100.2+dfsg-1ubuntu0.18.04.1
    • 0.100.3+dfsg-0ubuntu0.18.04.1
    • 0.101.4+dfsg-0ubuntu0.18.04.1
    • 0.102.1+dfsg-0ubuntu0.18.04.2
    • 0.102.2+dfsg-0ubuntu0.18.04.1
    • 0.102.3+dfsg-0ubuntu0.18.04.1
    • 0.102.4+dfsg-0ubuntu0.18.04.1
    • 0.103.2+dfsg-0ubuntu0.18.04.1
    • 0.103.2+dfsg-0ubuntu0.18.04.2
    • 0.103.2+dfsg-0ubuntu0.18.04.3
    • 0.103.5+dfsg-0ubuntu0.18.04.1
    • 0.103.6+dfsg-0ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 0.103.8+dfsg-0ubuntu0.18.04.1

    Update to 0.103.8+dfsg-0ubuntu0.18.04.1

  • clamav Ubuntu:20.04:LTS

    Versions
    • 0.101.4+dfsg-1ubuntu1
    • 0.102.1+dfsg-1ubuntu1
    • 0.102.1+dfsg-2ubuntu1
    • 0.102.1+dfsg-2ubuntu2
    • 0.102.2+dfsg-1ubuntu1
    • 0.102.2+dfsg-2ubuntu1
    • 0.102.3+dfsg-0ubuntu0.20.04.1
    • 0.102.4+dfsg-0ubuntu0.20.04.1
    • 0.103.2+dfsg-0ubuntu0.20.04.1
    • 0.103.2+dfsg-0ubuntu0.20.04.2
    • 0.103.5+dfsg-1~20.04.1
    • 0.103.6+dfsg-0ubuntu0.20.04.1
    Affected ranges
    • ECOSYSTEM: < 0.103.8+dfsg-0ubuntu0.20.04.1

    Update to 0.103.8+dfsg-0ubuntu0.20.04.1

  • clamav Ubuntu:22.04:LTS

    Versions
    • 0.103.3+dfsg-1
    • 0.103.4+dfsg-1
    • 0.103.4+dfsg-1build1
    • 0.103.5+dfsg-1
    • 0.103.6+dfsg-0ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: < 0.103.8+dfsg-0ubuntu0.22.04.1

    Update to 0.103.8+dfsg-0ubuntu0.22.04.1

Original sources

Check your server →