CVE-2022-20792

NameCVE-2022-20792
DescriptionA vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load time, and possibly gain code execution. The vulnerability is due to improper bounds checking that may result in a multi-byte heap buffer overwflow write. An attacker could exploit this vulnerability by placing a crafted CDB ClamAV signature database file in the ClamAV database directory. An exploit could allow the attacker to run code as the clamav user.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3042-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
clamav (PTS)buster0.103.6+dfsg-0+deb10u1fixed
bullseye0.103.7+dfsg-0+deb11u1fixed
bookworm, sid0.103.7+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
clamavsourcestretch0.103.6+dfsg-0+deb9u1DLA-3042-1
clamavsourcebuster0.103.6+dfsg-0+deb10u1
clamavsourcebullseye0.103.6+dfsg-0+deb11u1
clamavsource(unstable)0.103.6+dfsg-1

Notes

https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html

Search for package or bug name: Reporting problems