CVE-2024-20328

A vulnerability in the VirusEvent feature of ClamAV could allow a local
attacker to inject arbitrary commands with the privileges of the
application service account.The vulnerability is due to unsafe handling of
file names. A local attacker could exploit this vulnerability by supplying
a file name containing command-line sequences. When processed on a system
using configuration options for the VirusEvent feature, the attacker could
cause the application to execute arbitrary commands. ClamAV has released
software updates that address this vulnerability. There are no workarounds
that address this vulnerability.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1063479&gt;

Notes