Vulnerability-Lookup

usn-6636-1

Vulnerability from osv_ubuntu

Published

2024-02-14 16:11

Modified

2024-02-14 16:11

Summary

clamav vulnerabilities

Details

It was discovered that ClamAV incorrectly handled parsing certain OLE2 files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20290)

Amit Schendel discovered that the ClamAV ClamD service incorrectly handled the VirusEvent feature. An attacker able to connect to ClamD could possibly use this issue to execute arbitrary code. (CVE-2024-20328)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6636-1	ADVISORY
	https://ubuntu.com/security/CVE-2024-20290	REPORT
	https://ubuntu.com/security/CVE-2024-20328	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "clamav",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-base",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-daemon",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-daemon-dbgsym",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-dbgsym",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-docs",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-freshclam-dbgsym",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-milter",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-milter-dbgsym",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamdscan",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "clamdscan-dbgsym",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "libclamav-dev",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "libclamav11",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          },
          {
            "binary_name": "libclamav11-dbgsym",
            "binary_version": "1.0.5+dfsg-0ubuntu0.23.10.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:23.10",
        "name": "clamav",
        "purl": "pkg:deb/ubuntu/clamav@1.0.5+dfsg-0ubuntu0.23.10.1?arch=source\u0026distro=mantic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5+dfsg-0ubuntu0.23.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.103.8+dfsg-0ubuntu1",
        "0.103.8+dfsg-0ubuntu2",
        "1.0.2+dfsg-1ubuntu1",
        "1.0.4+dfsg-0ubuntu0.23.10.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that ClamAV incorrectly handled parsing certain OLE2\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\ncrash, resulting in a denial of service. (CVE-2024-20290)\n\nAmit Schendel discovered that the ClamAV ClamD service incorrectly handled\nthe VirusEvent feature. An attacker able to connect to ClamD could possibly\nuse this issue to execute arbitrary code. (CVE-2024-20328)\n",
  "id": "USN-6636-1",
  "modified": "2024-02-14T16:11:25.366081Z",
  "published": "2024-02-14T16:11:25.366081Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6636-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-20290"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-20328"
    }
  ],
  "related": [
    "CVE-2024-20290",
    "UBUNTU-CVE-2024-20290",
    "CVE-2024-20328",
    "UBUNTU-CVE-2024-20328"
  ],
  "schema_version": "1.6.3",
  "summary": "clamav vulnerabilities"
}

CVE-2024-20290 (GCVE-0-2024-20290)

Vulnerability from cvelistv5 – Published: 2024-02-07 16:16 – Updated: 2025-02-13 17:32

Summary

A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-126 - Buffer Over-read

Assigner

cisco

References

3 references

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

3 products

Vendor	Product	Version
Cisco	Cisco Secure Endpoint	Affected: 6.0.9 Affected: 6.0.7 Affected: 6.1.5 Affected: 6.1.7 Affected: 6.1.9 Affected: 6.2.1 Affected: 6.2.5 Affected: 6.2.19 Affected: 6.2.3 Affected: 6.2.9 Affected: 6.3.5 Affected: 6.3.1 Affected: 6.3.7 Affected: 6.3.3 Affected: 7.0.5 Affected: 7.1.1 Affected: 7.1.5 Affected: 7.2.13 Affected: 7.2.7 Affected: 7.2.3 Affected: 7.2.11 Affected: 7.2.5 Affected: 7.3.1 Affected: 7.3.9 Affected: 7.3.3 Affected: 7.3.5 Affected: 8.1.7 Affected: 8.1.5 Affected: 8.1.3.21242 Affected: 8.1.7.21512 Affected: 8.1.3 Affected: 8.1.5.21322 Affected: 8.1.7.21417
Cisco	Cisco Secure Endpoint Private Cloud Administration Portal	Affected: N/A
Cisco	Cisco Secure Endpoint Private Cloud Console	Affected: N/A

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:59:41.158Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cisco-sa-clamav-hDffu6t",
            "tags": [
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MUDUPAHAAV6FPB2C2QIQCFJ4SHYBOTY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-07T20:34:45.866511Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T20:23:12.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Secure Endpoint",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.9"
            },
            {
              "status": "affected",
              "version": "6.0.7"
            },
            {
              "status": "affected",
              "version": "6.1.5"
            },
            {
              "status": "affected",
              "version": "6.1.7"
            },
            {
              "status": "affected",
              "version": "6.1.9"
            },
            {
              "status": "affected",
              "version": "6.2.1"
            },
            {
              "status": "affected",
              "version": "6.2.5"
            },
            {
              "status": "affected",
              "version": "6.2.19"
            },
            {
              "status": "affected",
              "version": "6.2.3"
            },
            {
              "status": "affected",
              "version": "6.2.9"
            },
            {
              "status": "affected",
              "version": "6.3.5"
            },
            {
              "status": "affected",
              "version": "6.3.1"
            },
            {
              "status": "affected",
              "version": "6.3.7"
            },
            {
              "status": "affected",
              "version": "6.3.3"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "7.1.1"
            },
            {
              "status": "affected",
              "version": "7.1.5"
            },
            {
              "status": "affected",
              "version": "7.2.13"
            },
            {
              "status": "affected",
              "version": "7.2.7"
            },
            {
              "status": "affected",
              "version": "7.2.3"
            },
            {
              "status": "affected",
              "version": "7.2.11"
            },
            {
              "status": "affected",
              "version": "7.2.5"
            },
            {
              "status": "affected",
              "version": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.3.9"
            },
            {
              "status": "affected",
              "version": "7.3.3"
            },
            {
              "status": "affected",
              "version": "7.3.5"
            },
            {
              "status": "affected",
              "version": "8.1.7"
            },
            {
              "status": "affected",
              "version": "8.1.5"
            },
            {
              "status": "affected",
              "version": "8.1.3.21242"
            },
            {
              "status": "affected",
              "version": "8.1.7.21512"
            },
            {
              "status": "affected",
              "version": "8.1.3"
            },
            {
              "status": "affected",
              "version": "8.1.5.21322"
            },
            {
              "status": "affected",
              "version": "8.1.7.21417"
            }
          ]
        },
        {
          "product": "Cisco Secure Endpoint Private Cloud Administration Portal",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "Cisco Secure Endpoint Private Cloud Console",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources.\r\n\r For a description of this vulnerability, see the ClamAV blog ."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "Buffer Over-read",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-14T03:06:14.395Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-clamav-hDffu6t",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MUDUPAHAAV6FPB2C2QIQCFJ4SHYBOTY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/"
        }
      ],
      "source": {
        "advisory": "cisco-sa-clamav-hDffu6t",
        "defects": [
          "CSCwh88483",
          "CSCwh88484"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20290",
    "datePublished": "2024-02-07T16:16:00.975Z",
    "dateReserved": "2023-11-08T15:08:07.627Z",
    "dateUpdated": "2025-02-13T17:32:30.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20328 (GCVE-0-2024-20328)

Vulnerability from cvelistv5 – Published: 2024-03-01 20:48 – Updated: 2025-11-04 18:22

Title

ClamAV VirusEvent File Processing Command Injection Vulnerability

Summary

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

cisco

References

2 references

URL	Tags
https://blog.clamav.net/2023/11/clamav-130-122-10…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

3 products

Vendor	Product	Version
Cisco	ClamAV	Affected: 1.2.0 Affected: 1.2.1
cisco	clamav	Affected: 1.2.0 cpe:2.3:a:cisco:clamav:1.2.0:::::::*
cisco	clamav	Affected: 1.2.1 cpe:2.3:a:cisco:clamav:1.2.1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cisco:clamav:1.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clamav",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "1.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:cisco:clamav:1.2.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "clamav",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "1.2.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T15:40:24.549668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T20:45:50.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:22:37.791Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ClamAV",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-01T20:48:15.328Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ClamAV VirusEvent File Processing Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20328",
    "datePublished": "2024-03-01T20:48:15.328Z",
    "dateReserved": "2023-11-08T15:08:07.641Z",
    "dateUpdated": "2025-11-04T18:22:37.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

ubuntu-cve-2024-20290

Vulnerability from osv_ubuntu

Published

2024-02-07 17:15

Modified

2026-04-22 07:47

Summary

Details

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-20290	REPORT
	https://sec.cloudapps.cisco.com/security/center/c…	REPORT
	https://blog.clamav.net/2023/11/clamav-130-122-10…	REPORT
	https://ubuntu.com/security/notices/USN-6636-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2024-20290	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "clamav",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-base",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-daemon",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-docs",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-milter",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamdscan",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "libclamav11",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "clamav",
        "purl": "pkg:deb/ubuntu/clamav@1.0.5+dfsg-1ubuntu1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5+dfsg-1ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2+dfsg-1ubuntu1",
        "1.0.3+dfsg-2ubuntu1",
        "1.0.4+dfsg-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.   This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources.   For a description of this vulnerability, see the ClamAV blog .",
  "id": "UBUNTU-CVE-2024-20290",
  "modified": "2026-04-22T07:47:57Z",
  "published": "2024-02-07T17:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-20290"
    },
    {
      "type": "REPORT",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t"
    },
    {
      "type": "REPORT",
      "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6636-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20290"
    }
  ],
  "related": [
    "USN-6636-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-20290"
  ]
}

ubuntu-cve-2024-20328

Vulnerability from osv_ubuntu

Published

2024-02-09 00:00

Modified

2026-04-22 07:47

Summary

Details

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-20328	REPORT
	https://blog.clamav.net/2023/11/clamav-130-122-10…	REPORT
	https://ubuntu.com/security/notices/USN-6636-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2024-20328	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "clamav",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-base",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-daemon",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-docs",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-milter",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "clamdscan",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          },
          {
            "binary_name": "libclamav11",
            "binary_version": "1.0.5+dfsg-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "clamav",
        "purl": "pkg:deb/ubuntu/clamav@1.0.5+dfsg-1ubuntu1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.5+dfsg-1ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2+dfsg-1ubuntu1",
        "1.0.3+dfsg-2ubuntu1",
        "1.0.4+dfsg-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
  "id": "UBUNTU-CVE-2024-20328",
  "modified": "2026-04-22T07:47:57Z",
  "published": "2024-02-09T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-20328"
    },
    {
      "type": "REPORT",
      "url": "https://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6636-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20328"
    }
  ],
  "related": [
    "USN-6636-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-20328"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

usn-6636-1

Vulnerability from osv_ubuntu

CVE-2024-20290 (GCVE-0-2024-20290)

CVE-2024-20328 (GCVE-0-2024-20328)

ubuntu-cve-2024-20290

Vulnerability from osv_ubuntu

ubuntu-cve-2024-20328

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature