CVE-2023-20212
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to...
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
- Record
CVE-2023-20212- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-825
- Updated
- 2026-11-02
EUVDEUVD-2023-24391
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
- Record
EUVD-2023-24391- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-25vx-3h3c-mwv8
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to...
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
- Record
GHSA-25vx-3h3c-mwv8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-825
- Updated
- 2026-11-02
NVD
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
- Record
CVE-2023-20212- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-825
- Updated
- 2026-11-02
OSV
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
- Record
CVE-2023-20212- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-20212
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
- Record
DEBIAN-CVE-2023-20212- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-20212
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.
- Record
UBUNTU-CVE-2023-20212- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1756202550 No score
Fix of 9 CVEs
- Update up to 1.4.3 LTS
- CVE-2025-20260
- CVE-2025-20234
- CVE-2025-20128
- CVE-2024-20505, CVE-2024-20506
- CVE-2023-20197
- CVE-2023-20212
- CVE-2023-20032
- CVE-2023-20052
- Record
CLSA-2025-1756202550- Updated
- 2026-11-02
OSVCLSA-2025-1756923561 No score
clamav: Fix of 8 CVEs
- Update to 1.0.9 LTS version
- CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser
- CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser
- CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files
- CVE-2024-20290: Fixed a possible heap overflow read bug in the OLE2 file parser
- CVE-2024-20328: Fixed a possible command injection in the 'VirusEvent' feature of the clamd service
- CVE-2023-20197: Fixed a possible denial of service in the HFS+ parser
- CVE-2023-20212: Fixed a possible DoS in the AutoIT file parser
- CVE-2023-20052: Fixed a possible remote information leak in the DMG file parser
- Record
CLSA-2025-1756923561- Updated
- 2026-11-02
OSVMGASA-2023-0257 No score
Updated clamav packages fix security vulnerability
A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. (CVE-2023-20197)
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition. (CVE-2023-20212)
- Record
MGASA-2023-0257- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clamavTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-baseTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-daemonTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-docTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-docsTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-freshclamTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-milterTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-testfilesTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamdscanTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
libclamav-devTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libclamav12TuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamavTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-dataTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-develTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-docTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-filesystemTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-freshclamTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-libTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-milterTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamdTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamavDebian:12 |
before 1.0.2+dfsg-1~deb12u1, plus listed versions 1.0.1+dfsg-2 |
1.0.2+dfsg-1~deb12u1 |
clamavDebian:13 |
before 1.0.2+dfsg-1 | 1.0.2+dfsg-1 |
clamavDebian:14 |
before 1.0.2+dfsg-1 | 1.0.2+dfsg-1 |
clamavMageia:8 From an advisory covering 2 CVEs |
before 0.103.10-1.mga8 | 0.103.10-1.mga8 |
clamavMageia:9 From an advisory covering 2 CVEs |
before 1.0.3-1.mga9 | 1.0.3-1.mga9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-20212 is a high vulnerability (CVSS 7.5) in Cisco Secure Endpoint, published August 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.44%, the 89th percentile. Fixed in clamav 1.0.2+dfsg-1~deb12u1.
References
sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-FTkhqMWZ
nvd.nist.gov/vuln/detail/CVE-2023-20212
github.com/advisories/GHSA-25vx-3h3c-mwv8
errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2025-1756202550.html
security-tracker.debian.org/tracker/CVE-2023-20212