Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2023-20052 EUVD-2023-24231GHSA-pcr4-7r58-755h

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV…

Published Feb 16, 2023 · Updated Aug 2, 2024 · Assigned by cisco

Vendor: Cisco Product: Cisco Secure Endpoint Package: clamav Package: clamav Package: clamav Package: clamav Category: Network devices Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:


A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.


This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.

Affected products

VendorProductAffectedFixed
Cisco Cisco Secure Endpoint 6.0.9, 6.0.7, 6.1.5, 6.1.7, 6.1.9, 6.2.1, 6.2.5, 6.2.19, 6.2.9, 6.3.5, 6.3.1, 6.3.7, 6.3.3, 7.0.5, 7.1.1, 7.1.5, 1.12.1, 1.12.2, 1.12.5, 1.12.0, 1.12.6, 1.12.3, 1.12.7, 1.12.4, 1.13.0, 1.13.1, 1.13.2, 1.11.0, 1.10.2, 1.10.1, 1.10.0, 1.14.0, 1.6.0, 1.9.0, 1.9.1, 1.8.1, 1.8.0, 1.8.4, 1.7.0, 7.2.13, 7… —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 clamav 1.0.1+dfsg-1 —
Debian 13 clamav 1.0.1+dfsg-1 —
Debian 12 clamav 1.0.1+dfsg-1 —
Debian 10 clamav 0.103.8+dfsg-0+deb10u1 DLA-3328-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS clamav 0.103.8+dfsg-0ubuntu0.22.04.1 USN-5887-1
Ubuntu 20.04 LTS clamav 0.103.8+dfsg-0ubuntu0.20.04.1 USN-5887-1
Ubuntu 18.04 LTS clamav 0.103.8+dfsg-0ubuntu0.18.04.1 USN-5887-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS clamav 0.103.8+dfsg-0ubuntu0.16.04.1+esm1 USN-5887-1
Ubuntu Pro 14.04 LTS clamav 0.103.8+dfsg-0ubuntu0.14.04.1+esm1 USN-5887-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLES 15 SP3 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLES 15 SP2 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLES 15 SP1 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLES 12 SP5 clamav 0.103.8-3.24.1 SUSE-SU-2023:0471-1
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP4 clamav 0.103.8-33.53.1 SUSE-SU-2023:0453-1
SLES 12 SP2 clamav 0.103.8-33.53.1 SUSE-SU-2023:0453-1
SLES for SAP 15 SP3 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLES for SAP 15 SP2 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLES for SAP 15 SP1 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLES for SAP 12 SP5 clamav 0.103.8-3.24.1 SUSE-SU-2023:0471-1
SLES for SAP 12 SP4 clamav 0.103.8-33.53.1 SUSE-SU-2023:0453-1
SLE Real Time 15 SP3 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLE HPC 15 SP3 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLE HPC 15 SP2 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SLE HPC 15 SP1 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SUSE OpenStack Cloud Crowbar 9 clamav 0.103.8-33.53.1 SUSE-SU-2023:0453-1
SUSE OpenStack Cloud 9 clamav 0.103.8-33.53.1 SUSE-SU-2023:0453-1
SUSE Manager Server 4.2 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SUSE Manager Proxy 4.2 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SUSE Enterprise Storage 7.1 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1
SUSE Enterprise Storage 7 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed clamav 0.103.8-1.1 openSUSE-SU-2024:12696-1
openSUSE Leap 15.4 clamav 0.103.8-150000.3.44.1 SUSE-SU-2023:0470-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 clamav 1.0.1-r0 —
Alpine v3.23 clamav 1.0.1-r0 —
Alpine v3.22 clamav 1.0.1-r0 —
Alpine v3.21 clamav 1.0.1-r0 —
Alpine v3.20 clamav 1.0.1-r0 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 clamav 1.0.1-r0 —
Alpine v3.18 clamav 1.0.1-r0 —
Alpine v3.17 clamav 0.105.2-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 clamd +8 0.103.8-1.amzn2023.0.1 ALAS2023-2023-112
Amazon Linux 2 clamd +8 0.103.8-1.amzn2.0.1 ALAS2-2023-1964

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) clamav 0.105.2-1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • nokn0wthing/CVE-2023-20052 ★ 29 · May 8, 2023

    CVE-2023-20052, information leak vulnerability in the DMG file parser of ClamAV

  • tralsesec/CVE-2023-20052 ★ 0 · May 16, 2026

    Original standalone Proof-of-Concept exploit and execution harness for CVE-2023-20052 (ClamAV DMG XML Entity Expansion).

  • MOHITSINGHPAPOLA/CVE-2023-20052 ★ 0 · Feb 14, 2026

    Working Docker build for the ClamAV XXE exploit (CVE-2023-20052), patched to compile on OpenSSL 3.0

  • cY83rR0H1t/CVE-2023-20052 ★ 0 · Jul 19, 2023

    CVE-2023-20052 information leak vulnerability in the DMG file parser of ClamAV

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 8

References