7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
0.017 Low
EPSS
Percentile
87.7%
The ClamAV project reports:
Fixed a possible double-free vulnerability in the OLE2 file
parser. Issue affects versions 0.104.0 through 0.104.2. Issue
identified by OSS-Fuzz.
Fixed a possible infinite loop vulnerability in the CHM file
parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
version 0.103.5 and prior versions. Thank you to Michaล Dardas
for reporting this issue.
Fixed a possible NULL-pointer dereference crash in the scan
verdict cache check. Issue affects versions 0.103.4, 0.103.5,
0.104.1, and 0.104.2. Thank you to Alexander Patrakov and
Antoine Gatineau for reporting this issue.
Fixed a possible infinite loop vulnerability in the TIFF file
parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
version 0.103.5 and prior versions. The issue only occurs if the
โโalert-broken-mediaโ ClamScan option is enabled. For ClamD,
the affected option is โAlertBrokenMedia yesโ, and for libclamav
it is the โCL_SCAN_HEURISTIC_BROKEN_MEDIAโ scan option. Thank
you to Michaล Dardas for reporting this issue.
Fixed a possible memory leak in the HTML file parser /
Javascript normalizer. Issue affects versions 0.104.0 through
0.104.2 and LTS version 0.103.5 and prior versions. Thank you to
Michaล Dardas for reporting this issue.
Fixed a possible multi-byte heap buffer overflow write
vulnerability in the signature database load module. The fix was
to update the vendored regex library to the latest version.
Issue affects versions 0.104.0 through 0.104.2 and LTS version
0.103.5 and prior versions. Thank you to Michaล Dardas for
reporting this issue.
7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
0.017 Low
EPSS
Percentile
87.7%