PT-2024-5936 · Unknown+5 · Clam Antivirus+5
Published
2024-09-04
·
Updated
2025-02-03
·
CVE-2024-20505
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Clam AntiVirus (ClamAV) versions 0.103.11 through 1.4.0
Description
A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process.
Recommendations
For Clam AntiVirus (ClamAV) versions 0.103.11 through 1.4.0, patch immediately to the latest version to fix the vulnerability. As a temporary workaround, consider restricting the use of the PDF parsing module until a patch is available. Avoid using the PDF parsing module to scan potentially malicious PDF files until the issue is resolved.
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Clam Antivirus
Clamav
Linuxmint
Suse
Ubuntu