Vulnerability-Lookup - Search a vulnerability

Refine your search

Product

Sort by

Order

Sources

CVE-2025-20260 (GCVE-0-2025-20260)

Vulnerability from nvd

Published

2025-06-18 17:08

Modified

2025-11-03 18:08

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Summary

A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.

References

URL

Tags

https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.4.2 Version: 1.4.1 Version: 1.4.0 Version: 1.3.2 Version: 1.3.1 Version: 1.3.0 Version: 1.2.3 Version: 1.2.2 Version: 1.2.1 Version: 1.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20260",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-19T03:55:07.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:08:44.167Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.2"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.3.2"
            },
            {
              "status": "affected",
              "version": "1.3.1"
            },
            {
              "status": "affected",
              "version": "1.3.0"
            },
            {
              "status": "affected",
              "version": "1.2.3"
            },
            {
              "status": "affected",
              "version": "1.2.2"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            },
            {
              "status": "affected",
              "version": "1.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.\r\n\r\nThis vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-18T17:08:36.207Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "clamav-143-and-109-security-patch",
          "url": "https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html"
        }
      ],
      "source": {
        "advisory": "clamav-143-and-109-security-patch",
        "defects": [
          "CSCwo64672"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "ClamAV PDF Scanning Buffer Overflow Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20260",
    "datePublished": "2025-06-18T17:08:36.207Z",
    "dateReserved": "2024-10-10T19:15:13.243Z",
    "dateUpdated": "2025-11-03T18:08:44.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-20506 (GCVE-0-2024-20506)

Vulnerability from nvd

Published

2024-09-04 21:28

Modified

2025-11-03 21:52

Severity ?

6.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Summary

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

References

URL

Tags

https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.4.0 Version: 1.3.2 Version: 1.0.6 Version: 1.0.5 Version: 1.0.4 Version: 1.0.3 Version: 1.0.2 Version: 1.0.1 Version: 1.0.0 Version: 1.2.x Version: 0.105.x Version: 0.104.x Version: 0.103.11 Version: 0.103.10 Version: 0.103.9 Version: 0.103.8 Version: 0.103.7 Version: 0.103.6 Version: 0.103.5 Version: 0.103.4 Version: 0.103.3 Version: 0.103.2 Version: 0.103.1 Version: 0.103.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T13:34:43.487532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-754",
                "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:59:30.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:52:31.990Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.3.2"
            },
            {
              "status": "affected",
              "version": "1.0.6"
            },
            {
              "status": "affected",
              "version": "1.0.5"
            },
            {
              "status": "affected",
              "version": "1.0.4"
            },
            {
              "status": "affected",
              "version": "1.0.3"
            },
            {
              "status": "affected",
              "version": "1.0.2"
            },
            {
              "status": "affected",
              "version": "1.0.1"
            },
            {
              "status": "affected",
              "version": "1.0.0"
            },
            {
              "status": "affected",
              "version": "1.2.x"
            },
            {
              "status": "affected",
              "version": "0.105.x"
            },
            {
              "status": "affected",
              "version": "0.104.x"
            },
            {
              "status": "affected",
              "version": "0.103.11"
            },
            {
              "status": "affected",
              "version": "0.103.10"
            },
            {
              "status": "affected",
              "version": "0.103.9"
            },
            {
              "status": "affected",
              "version": "0.103.8"
            },
            {
              "status": "affected",
              "version": "0.103.7"
            },
            {
              "status": "affected",
              "version": "0.103.6"
            },
            {
              "status": "affected",
              "version": "0.103.5"
            },
            {
              "status": "affected",
              "version": "0.103.4"
            },
            {
              "status": "affected",
              "version": "0.103.3"
            },
            {
              "status": "affected",
              "version": "0.103.2"
            },
            {
              "status": "affected",
              "version": "0.103.1"
            },
            {
              "status": "affected",
              "version": "0.103.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.\r\n\r\nThe vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T21:28:54.812Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html"
        }
      ],
      "source": {
        "defects": [
          "CSCwk31741"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "ClamAV Privilege Handling Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20506",
    "datePublished": "2024-09-04T21:28:54.812Z",
    "dateReserved": "2023-11-08T15:08:07.688Z",
    "dateUpdated": "2025-11-03T21:52:31.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-20505 (GCVE-0-2024-20505)

Vulnerability from nvd

Published

2024-09-04 21:23

Modified

2025-11-03 21:52

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process.

References

URL

Tags

https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.4.0 Version: 1.3.2 Version: 1.0.6 Version: 1.0.5 Version: 1.0.4 Version: 1.0.3 Version: 1.0.2 Version: 1.0.1 Version: 1.0.0 Version: 1.2.x Version: 0.105.x Version: 0.104.x Version: 0.103.11 Version: 0.103.10 Version: 0.103.9 Version: 0.103.8 Version: 0.103.7 Version: 0.103.6 Version: 0.103.5 Version: 0.103.4 Version: 0.103.3 Version: 0.103.2 Version: 0.103.1 Version: 0.103.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T13:35:13.258736Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:00:08.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:52:30.524Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.3.2"
            },
            {
              "status": "affected",
              "version": "1.0.6"
            },
            {
              "status": "affected",
              "version": "1.0.5"
            },
            {
              "status": "affected",
              "version": "1.0.4"
            },
            {
              "status": "affected",
              "version": "1.0.3"
            },
            {
              "status": "affected",
              "version": "1.0.2"
            },
            {
              "status": "affected",
              "version": "1.0.1"
            },
            {
              "status": "affected",
              "version": "1.0.0"
            },
            {
              "status": "affected",
              "version": "1.2.x"
            },
            {
              "status": "affected",
              "version": "0.105.x"
            },
            {
              "status": "affected",
              "version": "0.104.x"
            },
            {
              "status": "affected",
              "version": "0.103.11"
            },
            {
              "status": "affected",
              "version": "0.103.10"
            },
            {
              "status": "affected",
              "version": "0.103.9"
            },
            {
              "status": "affected",
              "version": "0.103.8"
            },
            {
              "status": "affected",
              "version": "0.103.7"
            },
            {
              "status": "affected",
              "version": "0.103.6"
            },
            {
              "status": "affected",
              "version": "0.103.5"
            },
            {
              "status": "affected",
              "version": "0.103.4"
            },
            {
              "status": "affected",
              "version": "0.103.3"
            },
            {
              "status": "affected",
              "version": "0.103.2"
            },
            {
              "status": "affected",
              "version": "0.103.1"
            },
            {
              "status": "affected",
              "version": "0.103.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThe vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T21:23:55.715Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html"
        }
      ],
      "source": {
        "defects": [
          "CSCwk44457"
        ],
        "discovery": "INTERNAL"
      },
      "title": "ClamAV Memory Handling DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20505",
    "datePublished": "2024-09-04T21:23:55.715Z",
    "dateReserved": "2023-11-08T15:08:07.688Z",
    "dateUpdated": "2025-11-03T21:52:30.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-20328 (GCVE-0-2024-20328)

Vulnerability from nvd

Published

2024-03-01 20:48

Modified

2025-11-04 18:22

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

References

URL

Tags

https://blog.clamav.net/2023/11/clamav-130-122-105-released.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.2.0 Version: 1.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cisco:clamav:1.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clamav",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "1.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:cisco:clamav:1.2.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clamav",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "1.2.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T15:40:24.549668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T20:45:50.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:22:37.791Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-01T20:48:15.328Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ClamAV VirusEvent File Processing Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20328",
    "datePublished": "2024-03-01T20:48:15.328Z",
    "dateReserved": "2023-11-08T15:08:07.641Z",
    "dateUpdated": "2025-11-04T18:22:37.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-20260 (GCVE-0-2025-20260)

Vulnerability from cvelistv5

Published

2025-06-18 17:08

Modified

2025-11-03 18:08

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Summary

A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.

References

URL

Tags

https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.4.2 Version: 1.4.1 Version: 1.4.0 Version: 1.3.2 Version: 1.3.1 Version: 1.3.0 Version: 1.2.3 Version: 1.2.2 Version: 1.2.1 Version: 1.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20260",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-19T03:55:07.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:08:44.167Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.2"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.3.2"
            },
            {
              "status": "affected",
              "version": "1.3.1"
            },
            {
              "status": "affected",
              "version": "1.3.0"
            },
            {
              "status": "affected",
              "version": "1.2.3"
            },
            {
              "status": "affected",
              "version": "1.2.2"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            },
            {
              "status": "affected",
              "version": "1.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.\r\n\r\nThis vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-18T17:08:36.207Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "clamav-143-and-109-security-patch",
          "url": "https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html"
        }
      ],
      "source": {
        "advisory": "clamav-143-and-109-security-patch",
        "defects": [
          "CSCwo64672"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "ClamAV PDF Scanning Buffer Overflow Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20260",
    "datePublished": "2025-06-18T17:08:36.207Z",
    "dateReserved": "2024-10-10T19:15:13.243Z",
    "dateUpdated": "2025-11-03T18:08:44.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-20506 (GCVE-0-2024-20506)

Vulnerability from cvelistv5

Published

2024-09-04 21:28

Modified

2025-11-03 21:52

Severity ?

6.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Summary

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

References

URL

Tags

https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.4.0 Version: 1.3.2 Version: 1.0.6 Version: 1.0.5 Version: 1.0.4 Version: 1.0.3 Version: 1.0.2 Version: 1.0.1 Version: 1.0.0 Version: 1.2.x Version: 0.105.x Version: 0.104.x Version: 0.103.11 Version: 0.103.10 Version: 0.103.9 Version: 0.103.8 Version: 0.103.7 Version: 0.103.6 Version: 0.103.5 Version: 0.103.4 Version: 0.103.3 Version: 0.103.2 Version: 0.103.1 Version: 0.103.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T13:34:43.487532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-754",
                "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:59:30.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:52:31.990Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.3.2"
            },
            {
              "status": "affected",
              "version": "1.0.6"
            },
            {
              "status": "affected",
              "version": "1.0.5"
            },
            {
              "status": "affected",
              "version": "1.0.4"
            },
            {
              "status": "affected",
              "version": "1.0.3"
            },
            {
              "status": "affected",
              "version": "1.0.2"
            },
            {
              "status": "affected",
              "version": "1.0.1"
            },
            {
              "status": "affected",
              "version": "1.0.0"
            },
            {
              "status": "affected",
              "version": "1.2.x"
            },
            {
              "status": "affected",
              "version": "0.105.x"
            },
            {
              "status": "affected",
              "version": "0.104.x"
            },
            {
              "status": "affected",
              "version": "0.103.11"
            },
            {
              "status": "affected",
              "version": "0.103.10"
            },
            {
              "status": "affected",
              "version": "0.103.9"
            },
            {
              "status": "affected",
              "version": "0.103.8"
            },
            {
              "status": "affected",
              "version": "0.103.7"
            },
            {
              "status": "affected",
              "version": "0.103.6"
            },
            {
              "status": "affected",
              "version": "0.103.5"
            },
            {
              "status": "affected",
              "version": "0.103.4"
            },
            {
              "status": "affected",
              "version": "0.103.3"
            },
            {
              "status": "affected",
              "version": "0.103.2"
            },
            {
              "status": "affected",
              "version": "0.103.1"
            },
            {
              "status": "affected",
              "version": "0.103.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.\r\n\r\nThe vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T21:28:54.812Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html"
        }
      ],
      "source": {
        "defects": [
          "CSCwk31741"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "ClamAV Privilege Handling Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20506",
    "datePublished": "2024-09-04T21:28:54.812Z",
    "dateReserved": "2023-11-08T15:08:07.688Z",
    "dateUpdated": "2025-11-03T21:52:31.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-20505 (GCVE-0-2024-20505)

Vulnerability from cvelistv5

Published

2024-09-04 21:23

Modified

2025-11-03 21:52

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process.

References

URL

Tags

https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.4.0 Version: 1.3.2 Version: 1.0.6 Version: 1.0.5 Version: 1.0.4 Version: 1.0.3 Version: 1.0.2 Version: 1.0.1 Version: 1.0.0 Version: 1.2.x Version: 0.105.x Version: 0.104.x Version: 0.103.11 Version: 0.103.10 Version: 0.103.9 Version: 0.103.8 Version: 0.103.7 Version: 0.103.6 Version: 0.103.5 Version: 0.103.4 Version: 0.103.3 Version: 0.103.2 Version: 0.103.1 Version: 0.103.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T13:35:13.258736Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:00:08.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:52:30.524Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.3.2"
            },
            {
              "status": "affected",
              "version": "1.0.6"
            },
            {
              "status": "affected",
              "version": "1.0.5"
            },
            {
              "status": "affected",
              "version": "1.0.4"
            },
            {
              "status": "affected",
              "version": "1.0.3"
            },
            {
              "status": "affected",
              "version": "1.0.2"
            },
            {
              "status": "affected",
              "version": "1.0.1"
            },
            {
              "status": "affected",
              "version": "1.0.0"
            },
            {
              "status": "affected",
              "version": "1.2.x"
            },
            {
              "status": "affected",
              "version": "0.105.x"
            },
            {
              "status": "affected",
              "version": "0.104.x"
            },
            {
              "status": "affected",
              "version": "0.103.11"
            },
            {
              "status": "affected",
              "version": "0.103.10"
            },
            {
              "status": "affected",
              "version": "0.103.9"
            },
            {
              "status": "affected",
              "version": "0.103.8"
            },
            {
              "status": "affected",
              "version": "0.103.7"
            },
            {
              "status": "affected",
              "version": "0.103.6"
            },
            {
              "status": "affected",
              "version": "0.103.5"
            },
            {
              "status": "affected",
              "version": "0.103.4"
            },
            {
              "status": "affected",
              "version": "0.103.3"
            },
            {
              "status": "affected",
              "version": "0.103.2"
            },
            {
              "status": "affected",
              "version": "0.103.1"
            },
            {
              "status": "affected",
              "version": "0.103.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThe vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T21:23:55.715Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html"
        }
      ],
      "source": {
        "defects": [
          "CSCwk44457"
        ],
        "discovery": "INTERNAL"
      },
      "title": "ClamAV Memory Handling DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20505",
    "datePublished": "2024-09-04T21:23:55.715Z",
    "dateReserved": "2023-11-08T15:08:07.688Z",
    "dateUpdated": "2025-11-03T21:52:30.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-20328 (GCVE-0-2024-20328)

Vulnerability from cvelistv5

Published

2024-03-01 20:48

Modified

2025-11-04 18:22

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

References

URL

Tags

https://blog.clamav.net/2023/11/clamav-130-122-105-released.html

Impacted products

	Vendor	Product	Version
	Cisco	ClamAV	Version: 1.2.0 Version: 1.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cisco:clamav:1.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clamav",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "1.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:cisco:clamav:1.2.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clamav",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "1.2.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T15:40:24.549668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T20:45:50.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:22:37.791Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-01T20:48:15.328Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ClamAV VirusEvent File Processing Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20328",
    "datePublished": "2024-03-01T20:48:15.328Z",
    "dateReserved": "2023-11-08T15:08:07.641Z",
    "dateUpdated": "2025-11-04T18:22:37.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2024-AVI-0317

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Cisco ClamAV. Elle permet à un attaquant de provoquer un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Cisco	ClamAV	ClamAV versions 1.3.x antérieures à 1.3.1

References

Title

Publication Time

Tags

Bulletin de sécurité ClamAV du 17 avril 2024

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ClamAV versions 1.3.x ant\u00e9rieures \u00e0 1.3.1",
      "product": {
        "name": "ClamAV",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-20380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20380"
    }
  ],
  "initial_release_date": "2024-04-18T00:00:00",
  "last_revision_date": "2024-04-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0317",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-04-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco ClamAV. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Cisco ClamAV",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ClamAV du 17 avril 2024",
      "url": "https://blog.clamav.net/2024/04/clamav-131-123-106-patch-versions.html"
    }
  ]
}

CERTFR-2021-AVI-246

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Cisco	ClamAV	ClamAV pour Windows versions antérieures à 0.103.2
Cisco	Small Business	les routeurs Cisco Small Business RV110W, RV130, RV130W et RV215W (ces produits sont en fin de vie donc aucun correctif ne sera publié pour la vulnérabilité critique CVE-2021-1459)
Cisco	N/A	Cisco Unified CM IM&P versions antérieures à 11.5(1)SU9
Cisco	Small Business	les routeurs Cisco Small Business RV134W versions antérieures à 1.0.1.21
Cisco	SD-WAN vManage	Cisco SD-WAN vManage versions 19.x et 20.x antérieures à 20.3.3
Cisco	SD-WAN vManage	Cisco SD-WAN vManage versions 20.4.x antérieures à 20.4.1
Cisco	N/A	Immunet versions antérieures à 7.4.0
Cisco	N/A	Cisco AMP for Endpoints pour Windows versions antérieures à 7.3.15
Cisco	Unity Connection	Cisco Unity Connection versions antérieures à 11.5(1)SU9
Cisco	Small Business	les routeurs Cisco Small Business RV132W versions antérieures à 1.0.1.15
Cisco	Unity Connection	Cisco Unity Connection versions 12.0.x et 12.5.x antérieures à 12.5(1)SU4
Cisco	Small Business	les routeurs Cisco Small Business RV160, RV160W, RV260, RV260P et RV260W versions antérieures à 1.0.01.03
Cisco	N/A	Cisco Unified CM IM&P versions 12.0.x et 12.5.x antérieures à 12.5(1)SU4
Cisco	N/A	Cisco Unified CM et Unified CM SME versions 12.0.x et 12.5.x antérieures à 12.5(1)SU4
Cisco	SD-WAN vManage	Cisco SD-WAN vManage versions antérieures à 19.2.4
Cisco	N/A	Cisco Unified CM et Unified CM SME versions antérieures à 11.5(1)SU9
Cisco	Small Business	les routeurs Cisco Small Business RV340, RV340W, RV345 et RV345P versions antérieures à 1.0.03.21
Cisco	N/A	Cisco Prime License Manager versions antérieures à 11.5(1)SU9

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-amp-imm-dll-tu79hvkO du 07 avril 2021	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-cucm-rce-pqVYwyb du 07 avril 2021	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-sb-rv-bypass-inject-Rbhgvfdx du 07 avril 2021	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-vmanage-YuTVWqy du 07 avril 2021	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-rv-multi-lldp-u7e4chCe du 07 avril 2021	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-rv-rce-q3rxHnvm du 07 avril 2021	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ClamAV pour Windows versions ant\u00e9rieures \u00e0 0.103.2",
      "product": {
        "name": "ClamAV",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "les routeurs Cisco Small Business RV110W, RV130, RV130W et RV215W (ces produits sont en fin de vie donc aucun correctif ne sera publi\u00e9 pour la vuln\u00e9rabilit\u00e9 critique CVE-2021-1459)",
      "product": {
        "name": "Small Business",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unified CM IM\u0026P versions ant\u00e9rieures \u00e0 11.5(1)SU9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "les routeurs Cisco Small Business RV134W versions ant\u00e9rieures \u00e0 1.0.1.21",
      "product": {
        "name": "Small Business",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco SD-WAN vManage versions 19.x et 20.x ant\u00e9rieures \u00e0 20.3.3",
      "product": {
        "name": "SD-WAN vManage",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco SD-WAN vManage versions 20.4.x ant\u00e9rieures \u00e0 20.4.1",
      "product": {
        "name": "SD-WAN vManage",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Immunet versions ant\u00e9rieures \u00e0 7.4.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco AMP for Endpoints pour Windows versions ant\u00e9rieures \u00e0 7.3.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unity Connection versions ant\u00e9rieures \u00e0 11.5(1)SU9",
      "product": {
        "name": "Unity Connection",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "les routeurs Cisco Small Business RV132W versions ant\u00e9rieures \u00e0 1.0.1.15",
      "product": {
        "name": "Small Business",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unity Connection versions 12.0.x et 12.5.x ant\u00e9rieures \u00e0 12.5(1)SU4",
      "product": {
        "name": "Unity Connection",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "les routeurs Cisco Small Business RV160, RV160W, RV260, RV260P et RV260W versions ant\u00e9rieures \u00e0 1.0.01.03",
      "product": {
        "name": "Small Business",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unified CM IM\u0026P versions 12.0.x et 12.5.x ant\u00e9rieures \u00e0 12.5(1)SU4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unified CM et Unified CM SME versions 12.0.x et 12.5.x ant\u00e9rieures \u00e0 12.5(1)SU4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco SD-WAN vManage versions ant\u00e9rieures \u00e0 19.2.4",
      "product": {
        "name": "SD-WAN vManage",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unified CM et Unified CM SME versions ant\u00e9rieures \u00e0 11.5(1)SU9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "les routeurs Cisco Small Business RV340, RV340W, RV345 et RV345P versions ant\u00e9rieures \u00e0 1.0.03.21",
      "product": {
        "name": "Small Business",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Prime License Manager versions ant\u00e9rieures \u00e0 11.5(1)SU9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-1473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1473"
    },
    {
      "name": "CVE-2021-1480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1480"
    },
    {
      "name": "CVE-2021-1479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1479"
    },
    {
      "name": "CVE-2021-1362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1362"
    },
    {
      "name": "CVE-2021-1309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1309"
    },
    {
      "name": "CVE-2021-1386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1386"
    },
    {
      "name": "CVE-2021-1472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1472"
    },
    {
      "name": "CVE-2021-1251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1251"
    },
    {
      "name": "CVE-2021-1459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1459"
    },
    {
      "name": "CVE-2021-1137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1137"
    },
    {
      "name": "CVE-2021-1308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1308"
    }
  ],
  "initial_release_date": "2021-04-08T00:00:00",
  "last_revision_date": "2021-04-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-246",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-04-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-amp-imm-dll-tu79hvkO du 07 avril 2021",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-imm-dll-tu79hvkO"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cucm-rce-pqVYwyb du 07 avril 2021",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-pqVYwyb"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sb-rv-bypass-inject-Rbhgvfdx du 07 avril 2021",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-bypass-inject-Rbhgvfdx"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-vmanage-YuTVWqy du 07 avril 2021",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-multi-lldp-u7e4chCe du 07 avril 2021",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCe"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-rce-q3rxHnvm du 07 avril 2021",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-rce-q3rxHnvm"
    }
  ]
}

Refine your search

10 vulnerabilities found for ClamAV by Cisco

CVE-2025-20260 (GCVE-0-2025-20260)

Vulnerability from nvd

CVE-2024-20506 (GCVE-0-2024-20506)

Vulnerability from nvd

CVE-2024-20505 (GCVE-0-2024-20505)

Vulnerability from nvd

CVE-2024-20328 (GCVE-0-2024-20328)

Vulnerability from nvd

CVE-2025-20260 (GCVE-0-2025-20260)

Vulnerability from cvelistv5

CVE-2024-20506 (GCVE-0-2024-20506)

Vulnerability from cvelistv5

CVE-2024-20505 (GCVE-0-2024-20505)

Vulnerability from cvelistv5

CVE-2024-20328 (GCVE-0-2024-20328)

Vulnerability from cvelistv5

CERTFR-2024-AVI-0317

Vulnerability from certfr_avis

Solution

CERTFR-2021-AVI-246

Vulnerability from certfr_avis

Solution