Summary
It was discovered that ClamAV incorrectly handled parsing ARJ archives. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2020-3327)
It was discovered that ClamAV incorrectly handled scanning malicious files.
A local attacker could possibly use this issue to delete arbitrary files.
(CVE-2020-3350)
It was discovered that ClamAV incorrectly handled parsing EGG archives. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2020-3481)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | clamav | 0.102.4+dfsg-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | clamav | 0.102.4+dfsg-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | clamav | 0.102.4+dfsg-0ubuntu0.20.04.1 |
Vulnerabilities 3
-
High 7.5
ClamAV ARJ Archive Parsing Denial of Service Vulnerability
A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer over…
-
High 7.5
Clam AntiVirus (ClamAV) Software Null Pointer Dereference Vulnerability
A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null p…
-
Medium 5.5
Cisco AMP for Endpoints and ClamAV Privilege Escalation Vulnerability
A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could …