Summary
It was discovered that ClamAV incorrectly handled certain PDF files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2024-20505)
It was discovered that ClamAV incorrectly handled logfile privileges. A
local attacker could use this issue to cause ClamAV to overwrite arbitrary
files, possibly leading to privilege escalation. (CVE-2024-20506)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | clamav | 0.103.12+dfsg-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | clamav | 0.103.12+dfsg-0ubuntu0.22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | clamav | 1.0.7+dfsg-0ubuntu0.24.04.1 |
Vulnerabilities 2
-
Medium 6.1
ClamAV Privilege Handling Escalation Vulnerability
A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authe…
-
Medium 4.0
ClamAV Memory Handling DoS
A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthe…