Source: clamav Version: 1.0.4+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 1.0.3+dfsg-1~deb12u1
Hi, The following vulnerabilities were published for clamav. CVE-2024-20290[0]: | A vulnerability in the OLE2 file format parser of ClamAV could allow | an unauthenticated, remote attacker to cause a denial of service | (DoS) condition on an affected device. This vulnerability is due | to an incorrect check for end-of-string values during scanning, | which may result in a heap buffer over-read. An attacker could | exploit this vulnerability by submitting a crafted file containing | OLE2 content to be scanned by ClamAV on an affected device. A | successful exploit could allow the attacker to cause the ClamAV | scanning process to terminate, resulting in a DoS condition on the | affected software and consuming available system resources. For a | description of this vulnerability, see the ClamAV blog . CVE-2024-20328[1]: | Fixed a possible command injection vulnerability in the "VirusEvent" | feature of ClamAV's ClamD service. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-20290 https://www.cve.org/CVERecord?id=CVE-2024-20290 [1] https://security-tracker.debian.org/tracker/CVE-2024-20328 https://www.cve.org/CVERecord?id=CVE-2024-20328 [2] https://blog.clamav.net/2023/11/clamav-130-122-105-released.html Regards, Salvatore
