CVE-2022-20698

NameCVE-2022-20698
DescriptionA vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
clamav (PTS)buster0.103.6+dfsg-0+deb10u1fixed
buster (security)0.103.9+dfsg-0+deb10u1fixed
bullseye0.103.10+dfsg-0+deb11u1fixed
bookworm1.0.3+dfsg-1~deb12u1fixed
trixie1.0.5+dfsg-1fixed
sid1.0.5+dfsg-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
clamavsourcebuster0.103.5+dfsg-0+deb10u1
clamavsourcebullseye0.103.5+dfsg-0+deb11u1
clamavsource(unstable)0.103.5+dfsg-1

Notes

[stretch] - clamav <postponed> (Minor issue; clean crash; follow stable updates)
https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html
https://github.com/Cisco-Talos/clamav/commit/9a6bb57f89721db637f4ddb5b233c1c4e23d223a (0.103.5)

Search for package or bug name: Reporting problems