Source: clamav Version: 1.0.1+dfsg-2 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 0.103.8+dfsg-0+deb11u1
Hi, The following vulnerabilities were published for clamav. CVE-2023-20197[0]: | A vulnerability in the filesystem image parser for Hierarchical File | System Plus (HFS+) of ClamAV could allow an unauthenticated, remote | attacker to cause a denial of service (DoS) condition on an affected | device. This vulnerability is due to an incorrect check for | completion when a file is decompressed, which may result in a loop | condition that could cause the affected software to stop responding. | An attacker could exploit this vulnerability by submitting a crafted | HFS+ filesystem image to be scanned by ClamAV on an affected device. | A successful exploit could allow the attacker to cause the ClamAV | scanning process to stop responding, resulting in a DoS condition on | the affected software and consuming available system resources. | For a description of this vulnerability, see the ClamAV blog . CVE-2023-20212[1]: | A vulnerability in the AutoIt module of ClamAV could allow an | unauthenticated, remote attacker to cause a denial of service (DoS) | condition on an affected device. This vulnerability is due to a | logic error in the memory management of an affected device. An | attacker could exploit this vulnerability by submitting a crafted | AutoIt file to be scanned by ClamAV on the affected device. A | successful exploit could allow the attacker to cause the ClamAV | scanning process to restart unexpectedly, resulting in a DoS | condition. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-20197 https://www.cve.org/CVERecord?id=CVE-2023-20197 [1] https://security-tracker.debian.org/tracker/CVE-2023-20212 https://www.cve.org/CVERecord?id=CVE-2023-20212 [1] https://blog.clamav.net/2023/07/2023-08-16-releases.html Regards, Salvatore
