Lucene search

Gentoo FoundationMGASA-2024-0048

HistoryFeb 25, 2024 - 1:51 a.m.

Updated clamav packages fix security vulnerabilities

2024-02-2501:51:43

Gentoo Foundation

advisories.mageia.org

clamav

packages

security

vulnerabilities

heap overflow

denial-of-service

command injection

virusevent

clamd

unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.1

Confidence

Low

EPSS

0.001

Percentile

35.9%

JSON

The updated packages fix security vulnerabilities: A possible heap overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition. (CVE-2024-20290) A possible command injection vulnerability in the “VirusEvent” feature of ClamAV’s ClamD service. (CVE-2024-20328)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchclamav< 1.0.5-1clamav-1.0.5-1.mga9

OS	Version	Architecture	Package	Version	Filename
Mageia	9	noarch	clamav	< 1.0.5-1	clamav-1.0.5-1.mga9

References

blog.clamav.net/2023/11/clamav-130-122-105-released.html

bugs.mageia.org/show_bug.cgi?id=32815

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.1

Confidence

Low

EPSS

0.001

Percentile

35.9%

JSON

Related for MGASA-2024-0048