USN-5887-1 — clamav vulnerabilities

Summary

Simon Scannell discovered that ClamAV incorrectly handled parsing
HFS+ files. A remote attacker could possibly use this issue
to cause ClamAV to crash, resulting in a denial of service,
or execute arbitrary code. (CVE-2023-20032)

Simon Scannell discovered that ClamAV incorrectly handled parsing
DMG files. A remote attacker could possibly use this issue
to expose sensitive information. (CVE-2023-20052)

Fixed packages 5

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	clamav	0.103.8+dfsg-0ubuntu0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS	clamav	0.103.8+dfsg-0ubuntu0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS	clamav	0.103.8+dfsg-0ubuntu0.22.04.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	clamav	0.103.8+dfsg-0ubuntu0.14.04.1+esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	clamav	0.103.8+dfsg-0ubuntu0.16.04.1+esm1

Vulnerabilities 2

Critical 9.8

CVE-2023-20032 EPSS 30%

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ …

Cisco Cisco Secure Endpoint Cisco Secure Web Appliance Cisco Secure Endpoint Private Cloud Administration Portal Network devices Debian Ubuntu Azure Linux Alpine

Feb 16, 2023
Medium 5.3

CVE-2023-20052 Public exploit

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG f…

Cisco Cisco Secure Endpoint clamav clamav Network devices Debian Ubuntu Azure Linux Alpine

Feb 16, 2023

References

report
https://ubuntu.com/security/CVE-2023-20032
report
https://ubuntu.com/security/CVE-2023-20052

clamav vulnerabilities

Summary

Fixed packages 5

Vulnerabilities 2

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ …

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG f…

References