PT-2022-2517 · Clamav+5 · Clamav+5
Michal Dardas
·
Published
2022-04-20
·
Updated
2024-06-15
·
CVE-2022-20785
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
ClamAV versions 0.103.5 and earlier
ClamAV versions 0.104.0 through 0.104.2
Description
A vulnerability in the HTML file parser of Clam AntiVirus could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The issue is related to memory leaks when parsing HTML files, which can be exploited by sending a specially crafted HTML file to the antivirus software, causing a memory leak and leading to a denial of service attack.
Recommendations
For ClamAV versions 0.103.5 and earlier, update to a version later than 0.103.5.
For ClamAV versions 0.104.0 through 0.104.2, update to a version later than 0.104.2.
As a temporary workaround, consider restricting the parsing of HTML files until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Clamav
Linuxmint
Red Os
Suse
Ubuntu