CVE-2020-37167

Name	CVE-2020-37167
Description	ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clamav (PTS)	bullseye	0.103.10+dfsg-0+deb11u1	undetermined
	bullseye (security)	1.4.3+dfsg-1~deb11u1	undetermined
	bookworm	1.4.3+dfsg-1~deb12u2	undetermined
	trixie	1.4.3+dfsg-1	undetermined
	sid, forky	1.4.3+dfsg-2	undetermined

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
clamav	source	(unstable)	undetermined

https://www.exploit-db.com/exploits/47687
check upstream status