{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ClamAV versions ant\u00e9rieures \u00e0 1.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV 0.105 toutes versions (fin de vie)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV 1.1 toutes versions (fin de vie)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions ant\u00e9rieures \u00e0 1.2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV 0.104 toutes versions (fin de vie)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-20290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20290"
    },
    {
      "name": "CVE-2024-20328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20328"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0104",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits ClamAV\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service et une ex\u00e9cution de code\narbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits ClamAV",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ClamAV du 07 f\u00e9vrier 2024",
      "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ClamAV versions ant\u00e9rieures \u00e0 0.103.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions 1.0.x ant\u00e9rieures \u00e0 1.0.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions 1.2.x ant\u00e9rieures \u00e0 1.2.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions 1.1.x ant\u00e9rieures \u00e0 1.1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2023-AVI-0888",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-10-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans ClamAV. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans ClamAV",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ClamAV clamav-121-113-104-010311-patch du 25 octobre 2023",
      "url": "https://blog.clamav.net/2023/10/clamav-121-113-104-010311-patch.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ClamAV versions 0.103.x ant\u00e9rieures \u00e0 0.103.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions 1.1.x ant\u00e9rieures \u00e0 1.1.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions 1.0.x ant\u00e9rieures \u00e0 1.0.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-40477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40477"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 ClamAV\u00a0clamav-120-feature-version-and-111-102 du 28 ao\u00fbt 2023",
      "url": "https://blog.clamav.net/2023/08/clamav-120-feature-version-and-111-102.html"
    }
  ],
  "reference": "CERTFR-2023-AVI-0694",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-08-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eles\nproduits ClamAV\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits ClamAV",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ClamAV clamav-120-feature-version-and-111-102 du 28 ao\u00fbt 2023",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ClamAV versions ant\u00e9rieures \u00e0 0.103.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions ant\u00e9rieures \u00e0 0.105.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "ClamAV versions ant\u00e9rieures \u00e0 1.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-20052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20052"
    },
    {
      "name": "CVE-2023-20032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20032"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 ClamAV du 15 f\u00e9vrier 2023",
      "url": "https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html"
    }
  ],
  "reference": "CERTFR-2023-AVI-0140",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-02-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eClamAV\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une atteinte \u00e0\nla confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits ClamAV",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ClamAV du 15 f\u00e9vrier 2023",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ClamAV version 0.90RC1.1 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDeux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans ClamAV :\n\n-   un probl\u00e8me de lib\u00e9ration de ressources lors de la validation de\n    l\u0027ent\u00eate des fichiers de type cabinet (fichier CAB) peut permettre \u00e0\n    une personne distante malintentionn\u00e9e de r\u00e9aliser un d\u00e9ni de service\n    en bloquant toutes les ressources disponibles ;\n-   un manque de validation d\u0027un param\u00e8tre des ent\u00eates MIME pourrait\n    permettre \u00e0 un utilisateur malveillant de contourner la politique de\n    s\u00e9curit\u00e9 en modifiant des fichiers prot\u00e9g\u00e9s de l\u0027antivirus.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-0898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0898"
    },
    {
      "name": "CVE-2007-0897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0897"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 iDefense 475 du 15 f\u00e9vrier 2007 :",
      "url": "http://www.idefense.com/application/poi/display?id=475"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 SuSE :",
      "url": "http://lists.suse.com/archive/suse-security-announce/2007-Feb/0004.html"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Gentoo :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200703-03.xml"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Debian :",
      "url": "http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00018.html"
    },
    {
      "title": "Bulletin Mandriva MDKSA-2007:043 du 19 f\u00e9vrier 2007 :",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:043"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 iDefense 476 du 15 f\u00e9vrier 2007 :",
      "url": "http://www.idefense.com/application/poi/display?id=476"
    }
  ],
  "reference": "CERTA-2007-AVI-093",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2007-02-16T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence Mandriva ;",
      "revision_date": "2007-02-21T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences Debian, SuSE et Gentoo.",
      "revision_date": "2007-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans ClamAV permettent \u00e0 un\nutilisateur distant de contourner la politique de s\u00e9curit\u00e9 ou de\nr\u00e9aliser un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans ClamAV",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 iDefense 475 et 476 du 15 f\u00e9vrier 2007",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ArcaBit ArcaVir",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "AVG AVG Anti-Virus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Softwin BitDefender",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "H+BEDV AntiVir",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Norman Virus Control",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Panda ActiveScan",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "VirusBlokAda VBA32",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Computer Associates eTrust EZ Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "F-Secure Anti-Virus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Computer Associates Vet Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Avast! Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Cat Computer Services Quick Heal Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Ikarus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Ukrainian Antiviral Center Ukrainian National Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Symantec Norton Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Symantec",
          "scada": false
        }
      }
    },
    {
      "description": "Panda Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Symantec",
          "scada": false
        }
      }
    },
    {
      "description": "Hacksoft TheHacker",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Symantec",
          "scada": false
        }
      }
    },
    {
      "description": "McAfee VirusScan",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "McAfee",
          "scada": false
        }
      }
    },
    {
      "description": "Eset Software NOD32 Antivirus",
      "product": {
        "name": "NOD32 Antivirus",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Fortinet Antivirus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "Kaspersky Labs (tous produits)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Kaspersky",
          "scada": false
        }
      }
    },
    {
      "description": "Sophos Anti-Virus",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Sophos",
          "scada": false
        }
      }
    },
    {
      "description": "Clam Anti-Virus ClamAV",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ClamAV",
          "scada": false
        }
      }
    },
    {
      "description": "Dr.Web",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2005-10-11",
  "content": "## Description\n\nLa plupart des antivirus du march\u00e9 sont vuln\u00e9rables \u00e0 un contournement\nde politique de s\u00e9curit\u00e9.\n\nEn effet, il est possible gr\u00e2ce \u00e0 un fichier archive malicieusement\nconstruit, de passer outre le syst\u00e8me de filtrage de l\u0027antivirus. Ainsi,\nun virus contenu dans ce fichier archive sera achemin\u00e9 vers son\ndestinataire sans traitement pr\u00e9alable par une passerelle antivirus.\n\n  \n\nUne fois arriv\u00e9 sur le poste utilisateur, le fichier virus contenu dans\nl\u0027archive doit \u00eatre extrait puis ex\u00e9cut\u00e9 par l\u0027utilisateur pour\ncorrompre la machine.\n\n## Contournement provisoire\n\nTant que le virus n\u0027est pas extrait de l\u0027archive sur le poste client\ncible, aucun code malveillant n\u0027est ex\u00e9cut\u00e9. Il convient donc de\nrespecter les r\u00e8gles de comportement \u00e9l\u00e9mentaires d\u0027utilisation de la\nmessagerie, rappel\u00e9s ci-dessous :\n\n-   mettre \u00e0 jour son antivirus ;\n-   ne pas ouvrir les mails \u00e0 caract\u00e8re douteux ;\n-   ne jamais ouvrir les fichiers archives en cas de doute sur leur\n    provenance ;\n-   v\u00e9rifier syst\u00e9matiquement le contenu extrait des archives ;\n-   Dans le cadre de la d\u00e9fense en profondeur, privil\u00e9gier\n    syst\u00e9matiquement l\u0027emploi d\u0027un antivirus sur la passerelle de\n    messagerie associ\u00e9 \u00e0 un antivirus diff\u00e9rent sur les postes de\n    travail.\n\n## Solution\n\nAucune solution n\u0027a \u00e9t\u00e9 communiqu\u00e9e pour l\u0027instant par les \u00e9diteurs\nd\u0027antivirus.\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de Security Focus :",
      "url": "http://www.securityfocus.com/bid/15046"
    },
    {
      "title": "M\u00e9mento du CERTA sur les virus : CERTA-2005-MEM-001",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2005-MEM-001.pdf"
    }
  ],
  "reference": "CERTA-2005-ALE-014",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2005-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Contournement du syst\u00e8me de filtrage de l\u0027antivirus"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans le traitement des archives affecte la\nquasi-totalit\u00e9 des antivirus du march\u00e9. Ainsi, les antivirus ne peuvent\nrep\u00e9rer un virus ins\u00e9r\u00e9 dans une archive malicieusement construite.\n",
  "title": "Vuln\u00e9rabilit\u00e9 d\u0027un grand nombre d\u0027antivirus",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de \"Security Focus\"",
      "url": null
    }
  ]
}