PT-2024-1550 · Clamav+1 · Clamav+1

Published 2024-02-07 · Updated 2026-02-06 · CVE-2024-20290

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ClamAV (affected versions not specified)

Description A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Buffer Over-read

Weakness Enumeration

CWE-125

CWE-126

Related Identifiers

BDU:2024-01085

CLEANSTART-2026-LA13761

CLEANSTART-2026-NJ87139

CLEANSTART-2026-TC95380

CLEANSTART-2026-WX01708

CVE-2024-20290

MGASA-2024-0048

USN-6636-1

Affected Products

Clamav

Ubuntu

References · 106

• https://nvd.nist.gov/vuln/detail/CVE-2017-11423 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12376 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0361 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20290 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20197 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1404 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0202 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0048 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-20290 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20698 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-NJ87139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6419 · Security Note
• https://ubuntu.com/security/CVE-2024-20328 · Vendor Advisory