CVE-2024-20506

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.

The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.

The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

Clam AntiVirus (clamav) is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. he virus database is based on the virus database from OpenAntiVirus, but contains additional signatures and is KEPT UP TO DATE.

Security Fix(es):

A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process.(CVE-2024-20505)

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.

The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.(CVE-2024-20506)

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

• Update up to 1.4.3 LTS
  • CVE-2025-20260
  • CVE-2025-20234
  • CVE-2025-20128
  • CVE-2024-20505, CVE-2024-20506
  • CVE-2023-20197
  • CVE-2023-20212
  • CVE-2023-20032
  • CVE-2023-20052

• Update to 1.4.3 LTS
• CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser
• CVE-2025-20234: Fixed a possible buffer overflow read bug in the UDF file parser
• CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser
• CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files

• Update to 1.0.9 LTS version
• CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser
• CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser
• CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files
• CVE-2024-20290: Fixed a possible heap overflow read bug in the OLE2 file parser
• CVE-2024-20328: Fixed a possible command injection in the 'VirusEvent' feature of the clamd service
• CVE-2023-20197: Fixed a possible denial of service in the HFS+ parser
• CVE-2023-20212: Fixed a possible DoS in the AutoIT file parser
• CVE-2023-20052: Fixed a possible remote information leak in the DMG file parser

Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service (DoS) condition. (CVE-2024-20505) Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files. (CVE-2024-20506)

These are all security issues fixed in the clamav-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for clamav fixes the following issues:

• Update to version 0.103.12
• CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. (bsc#1230162)
• CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. (bsc#1230161)

This update for clamav fixes the following issues:

• Update to version 0.103.12
• CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. (bsc#1230162)
• CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. (bsc#1230161)

This update for clamav fixes the following issues:

• Update to version 0.103.12
• CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. (bsc#1230162)
• CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. (bsc#1230161)

This update for clamav fixes the following issues:

New version 1.4.2:

• CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

• Start clamonacc with --fdpass to avoid errors due to clamd not being able to access user files. (bsc#1232242)

• New version 1.4.1:

  • https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

• New version 1.4.0:

  • Added support for extracting ALZ archives.
  • Added support for extracting LHA/LZH archives.
  • Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
  • https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html

• New version 1.3.2:

  • CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
  • CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
  • Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
  • Fix unit test caused by expiring signing certificate.
  • Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures.
  • Fixed an unaligned pointer dereference issue on select architectures.
  • Fixes to Jenkins CI pipeline.

• New Version: 1.3.1:

  • CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.
  • Updated select Rust dependencies to the latest versions.
  • Fixed a bug causing some text to be truncated when converting from UTF-16.
  • Fixed assorted complaints identified by Coverity static analysis.
  • Fixed a bug causing CVDs downloaded by the DatabaseCustomURL
  • Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

• New version: 1.3.0:

  • Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled.
  • Added file type recognition for compiled Python ('.pyc') files.
  • Improved support for decrypting PDFs with empty passwords.
  • Fixed a warning when scanning some HTML files.
  • ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
  • ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.

• New version: 1.2.0:

  • Added support for extracting Universal Disk Format (UDF) partitions.
  • Added an option to customize the size of ClamAV's clean file cache.
  • Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
  • Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror.
  • Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
  • PID and socket are now located under /run/clamav/clamd.pid and /run/clamav/clamd.sock .
  • bsc#1211594: Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature.

• New version 1.1.0:

  • https://blog.clamav.net/2023/05/clamav-110-released.html
  • Added the ability to extract images embedded in HTML CSS

    <style> blocks.

  • Updated to Sigtool so that the '--vba' option will extract VBA code from Microsoft Office documents the same way that …

This update for clamav fixes the following issues:

New version 1.4.2:

• CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

• Start clamonacc with --fdpass to avoid errors due to clamd not being able to access user files. (bsc#1232242)

• New version 1.4.1:

  • https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

• New version 1.4.0:

  • Added support for extracting ALZ archives.
  • Added support for extracting LHA/LZH archives.
  • Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
  • https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html

• New version 1.3.2:

  • CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
  • CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
  • Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
  • Fix unit test caused by expiring signing certificate.
  • Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures.
  • Fixed an unaligned pointer dereference issue on select architectures.
  • Fixes to Jenkins CI pipeline.

• New Version: 1.3.1:

  • CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.
  • Updated select Rust dependencies to the latest versions.
  • Fixed a bug causing some text to be truncated when converting from UTF-16.
  • Fixed assorted complaints identified by Coverity static analysis.
  • Fixed a bug causing CVDs downloaded by the DatabaseCustomURL
  • Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

• New version: 1.3.0:

  • Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled.
  • Added file type recognition for compiled Python ('.pyc') files.
  • Improved support for decrypting PDFs with empty passwords.
  • Fixed a warning when scanning some HTML files.
  • ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
  • ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.

• New version: 1.2.0:

  • Added support for extracting Universal Disk Format (UDF) partitions.
  • Added an option to customize the size of ClamAV's clean file cache.
  • Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
  • Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror.
  • Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
  • PID and socket are now located under /run/clamav/clamd.pid and /run/clamav/clamd.sock .
  • bsc#1211594: Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature.

• New version 1.1.0:

  • https://blog.clamav.net/2023/05/clamav-110-released.html
  • Added the ability to extract images embedded in HTML CSS

    <style> blocks.

  • Updated to Sigtool so that the '--vba' option will extract VBA code from Microsoft Office documents the same way that …

This update for clamav fixes the following issues:

New version 1.4.2:

• CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

• Start clamonacc with --fdpass to avoid errors due to clamd not being able to access user files. (bsc#1232242)

• New version 1.4.1:

  • https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

• New version 1.4.0:

  • Added support for extracting ALZ archives.
  • Added support for extracting LHA/LZH archives.
  • Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
  • https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html

• New version 1.3.2:

  • CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
  • CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
  • Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
  • Fix unit test caused by expiring signing certificate.
  • Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures.
  • Fixed an unaligned pointer dereference issue on select architectures.
  • Fixes to Jenkins CI pipeline.

• New Version: 1.3.1:

  • CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.
  • Updated select Rust dependencies to the latest versions.
  • Fixed a bug causing some text to be truncated when converting from UTF-16.
  • Fixed assorted complaints identified by Coverity static analysis.
  • Fixed a bug causing CVDs downloaded by the DatabaseCustomURL
  • Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

• New version: 1.3.0:

  • Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled.
  • Added file type recognition for compiled Python ('.pyc') files.
  • Improved support for decrypting PDFs with empty passwords.
  • Fixed a warning when scanning some HTML files.
  • ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
  • ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.

• New version: 1.2.0:

  • Added support for extracting Universal Disk Format (UDF) partitions.
  • Added an option to customize the size of ClamAV's clean file cache.
  • Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
  • Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror.
  • Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
  • PID and socket are now located under /run/clamav/clamd.pid and /run/clamav/clamd.sock .
  • bsc#1211594: Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature.

• New version 1.1.0:

  • https://blog.clamav.net/2023/05/clamav-110-released.html
  • Added the ability to extract images embedded in HTML CSS

    <style> blocks.

  • Updated to Sigtool so that the '--vba' option will extract VBA code from Microsoft Office documents the same way that …

It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20505)

It was discovered that ClamAV incorrectly handled logfile privileges. A local attacker could use this issue to cause ClamAV to overwrite arbitrary files, possibly leading to privilege escalation. (CVE-2024-20506)

USN-7011-1 fixed several vulnerabilities in ClamAV. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20505)

It was discovered that ClamAV incorrectly handled logfile privileges. A local attacker could use this issue to cause ClamAV to overwrite arbitrary files, possibly leading to privilege escalation. (CVE-2024-20506)