CVE-2023-20212

2023-08-1800:00:00

ubuntu.com

clamav

autoit

vulnerability

unauthenticated

remote attacker

denial of service

memory management

logic error

dos condition

crafted file

exploit

scanning process

restart

unexpected

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

26.8%

JSON

A vulnerability in the AutoIt module of ClamAV could allow an
unauthenticated, remote attacker to cause a denial of service (DoS)
condition on an affected device. This vulnerability is due to a logic error
in the memory management of an affected device. An attacker could exploit
this vulnerability by submitting a crafted AutoIt file to be scanned by
ClamAV on the affected device. A successful exploit could allow the
attacker to cause the ClamAV scanning process to restart unexpectedly,
resulting in a DoS condition.