{"id":"CVE-2020-3341","aliases":["ALPINE-CVE-2020-3341","DEBIAN-CVE-2020-3341","DLA-2215-1","EUVD-2020-24612","GHSA-cv4g-3f4x-7fw8","MGASA-2020-0226","SUSE-SU-2020:3729-1","SUSE-SU-2020:3790-1","SUSE-SU-2020:3918-1","SUSE-SU-2021:14592-1","UBUNTU-CVE-2020-3341","USN-4370-1","USN-4370-2","openSUSE-SU-2020:2268-1","openSUSE-SU-2020:2276-1","openSUSE-SU-2024:10685-1"],"status":"published","title":"ClamAV PDF Parsing Denial of Service Vulnerability","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03448,"percentile":0.89095,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2020-05-13T02:20:13Z","modified":"2026-11-03T06:32:25Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"clamav","fixed_in":["0.102.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"clamav","fixed_in":["0.102.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"clamav","fixed_in":["0.102.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"clamav","fixed_in":["0.102.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","fixed_in":["0.102.3+dfsg-0ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"clamav","fixed_in":["0.102.3+dfsg-0ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"clamav","fixed_in":["0.102.3+dfsg-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"clamav","fixed_in":["0.102.3+dfsg-0ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.101.5+dfsg-0+deb8u2"}]}],"versions":["0.100.0+dfsg-0+deb8u1","0.100.0+dfsg-1","0.100.0~beta+dfsg-1","0.100.0~beta+dfsg-2","0.100.1+dfsg-0+deb8u1","0.100.1+dfsg-1","0.100.2+dfsg-0+deb8u1","0.100.2+dfsg-1","0.100.2+dfsg-2","0.100.3+dfsg-0+deb8u1","0.101.0+dfsg-1","0.101.1+dfsg-1","0.101.1+dfsg-2","0.101.1+dfsg-3","0.101.2+dfsg-1","0.101.2+dfsg-2","0.101.2+dfsg-3","0.101.4+dfsg-0+deb8u1","0.101.4+dfsg-0+deb8u2","0.101.4+dfsg-1","0.101.5+dfsg-0+deb8u1","0.98.6+dfsg-1","0.98.6+dfsg-1+deb8u1","0.98.6+dfsg-2","0.98.6+dfsg-3","0.98.7+dfsg-0+deb8u1","0.98.7+dfsg-1","0.98.7+dfsg-2","0.98.7+dfsg-3","0.98.7+dfsg-4","0.98.7+dfsg-5","0.99+dfsg-0+deb8u1","0.99+dfsg-0+deb8u2","0.99+dfsg-1","0.99+dfsg-2","0.99.1+dfsg-1","0.99.2+dfsg-0+deb8u1","0.99.2+dfsg-0+deb8u2","0.99.2+dfsg-0+deb8u3","0.99.2+dfsg-1","0.99.2+dfsg-2","0.99.2+dfsg-3","0.99.2+dfsg-4","0.99.2+dfsg-5","0.99.2+dfsg-6","0.99.3~beta1+dfsg-1","0.99.3~beta1+dfsg-2","0.99.3~beta1+dfsg-3","0.99.3~beta1+dfsg-4","0.99.3~beta2+dfsg-1","0.99.3~snapshot20170704+dfsg-1","0.99.4+dfsg-1+deb8u1","0.99~beta1+dfsg-1","0.99~rc2+dfsg-1","0.99~rc2+dfsg-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-3.23.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-3.23.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-33.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-0.20.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-0.20.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.14.04.1+esm1"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3","0.100.1+dfsg-1ubuntu0.14.04.4","0.100.2+dfsg-1ubuntu0.14.04.1","0.100.2+dfsg-1ubuntu0.14.04.2","0.100.3+dfsg-0ubuntu0.14.04.1","0.100.3+dfsg-0ubuntu0.14.04.1+esm1","0.101.4+dfsg-0ubuntu0.14.04.1+esm1","0.102.1+dfsg-0ubuntu0.14.04.1+esm1","0.102.2+dfsg-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.16.04.1"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2","0.100.1+dfsg-1ubuntu0.16.04.3","0.100.2+dfsg-1ubuntu0.16.04.1","0.100.3+dfsg-0ubuntu0.16.04.1","0.101.4+dfsg-0ubuntu0.16.04.1","0.102.1+dfsg-0ubuntu0.16.04.2","0.102.2+dfsg-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.18.04.1"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2","0.100.1+dfsg-1ubuntu0.18.04.3","0.100.2+dfsg-1ubuntu0.18.04.1","0.100.3+dfsg-0ubuntu0.18.04.1","0.101.4+dfsg-0ubuntu0.18.04.1","0.102.1+dfsg-0ubuntu0.18.04.2","0.102.2+dfsg-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.20.04.1"}]}],"versions":["0.101.4+dfsg-1ubuntu1","0.102.1+dfsg-1ubuntu1","0.102.1+dfsg-2ubuntu1","0.102.1+dfsg-2ubuntu2","0.102.2+dfsg-1ubuntu1","0.102.2+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.16.04.1"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2","0.100.1+dfsg-1ubuntu0.16.04.3","0.100.2+dfsg-1ubuntu0.16.04.1","0.100.3+dfsg-0ubuntu0.16.04.1","0.101.4+dfsg-0ubuntu0.16.04.1","0.102.1+dfsg-0ubuntu0.16.04.2","0.102.2+dfsg-0ubuntu0.16.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.18.04.1"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2","0.100.1+dfsg-1ubuntu0.18.04.3","0.100.2+dfsg-1ubuntu0.18.04.1","0.100.3+dfsg-0ubuntu0.18.04.1","0.101.4+dfsg-0ubuntu0.18.04.1","0.102.1+dfsg-0ubuntu0.18.04.2","0.102.2+dfsg-0ubuntu0.18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.20.04.1"}]}],"versions":["0.101.4+dfsg-1ubuntu1","0.102.1+dfsg-1ubuntu1","0.102.1+dfsg-2ubuntu1","0.102.1+dfsg-2ubuntu2","0.102.2+dfsg-1ubuntu1","0.102.2+dfsg-2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.3+dfsg-0ubuntu0.14.04.1+esm1"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3","0.100.1+dfsg-1ubuntu0.14.04.4","0.100.2+dfsg-1ubuntu0.14.04.1","0.100.2+dfsg-1ubuntu0.14.04.2","0.100.3+dfsg-0ubuntu0.14.04.1","0.100.3+dfsg-0ubuntu0.14.04.1+esm1","0.101.4+dfsg-0ubuntu0.14.04.1+esm1","0.102.1+dfsg-0ubuntu0.14.04.1+esm1","0.102.2+dfsg-0ubuntu0.14.04.1+esm1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-lp151.2.12.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.0-lp152.6.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.3-1.4"}]}],"bundled":55}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"cisco","product":"clam_antivirus"},{"vendor":"cisco","product":"clamav"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5YWYT27SBTV4RZSGFHIQUI4LQVFASWS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROBJOGJOT44MVDX7RQEACYHQN4LYW5RK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BMTC7I5LGY4FCIZLHPNC4WWC6VNLFER/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4370-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4370-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-3341"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3BMTC7I5LGY4FCIZLHPNC4WWC6VNLFER/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5YWYT27SBTV4RZSGFHIQUI4LQVFASWS/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBJOGJOT44MVDX7RQEACYHQN4LYW5RK/"},{"url":"https://github.com/advisories/GHSA-cv4g-3f4x-7fw8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-3341","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-3341","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0226.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26653","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2215","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118459","tags":["report"]},{"url":"https://bugzilla.suse.com/1119353","tags":["report"]},{"url":"https://bugzilla.suse.com/1144504","tags":["report"]},{"url":"https://bugzilla.suse.com/1149458","tags":["report"]},{"url":"https://bugzilla.suse.com/1151839","tags":["report"]},{"url":"https://bugzilla.suse.com/1157763","tags":["report"]},{"url":"https://bugzilla.suse.com/1171981","tags":["report"]},{"url":"https://bugzilla.suse.com/1174250","tags":["report"]},{"url":"https://bugzilla.suse.com/1174255","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-3481","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203790-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1104457","tags":["report"]},{"url":"https://bugzilla.suse.com/1130721","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1798","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203918-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114592-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-3341","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4370-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4370-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-3341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-3327","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAR55SQV75RXSJVDKQWD4CZNKDOYFY5P/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DHFME6EFDMW6BQBIYMTU3MBXQLVR7QTK/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-4182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-1405","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-3341","title":"ClamAV PDF Parsing Denial of Service Vulnerability","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2020-05-13T02:20:13.497Z","modified":"2024-11-15T17:21:52.637Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:51.923913Z"}],"euvd":[{"id":"EUVD-2020-24612","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2020-05-13T02:20:13Z","modified":"2024-11-15T17:21:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:59.043854Z"}],"ghsa":[{"id":"GHSA-cv4g-3f4x-7fw8","title":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0...","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2022-05-24T17:17:49Z","modified":"2023-01-29T05:02:30Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:45:06.209197Z"}],"nvd":[{"id":"CVE-2020-3341","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2020-05-13T03:15:11.2Z","modified":"2026-06-17T03:18:00.377Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"ALPINE-CVE-2020-3341","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2020-05-13T03:15:11.2Z","modified":"2026-11-03T06:32:25.7402886Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-3341","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2020-05-13T03:15:11.2Z","modified":"2026-04-16T04:32:35.839622568Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-3341","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2020-05-13T03:15:11.2Z","modified":"2026-10-26T12:02:48.362234388Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-3341","description":"A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.","status":"published","published":"2020-05-13T03:15:00Z","modified":"2026-04-22T12:39:51.926679Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2215-1","title":"clamav - security update","status":"published","published":"2020-05-20T00:00:00Z","modified":"2026-03-09T01:18:29.978802Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0226","title":"Updated clamav packages fix security vulnerabilities","description":"Updated clamav packages fix security vulnerabilities:\n\nFixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.2\nthat could cause a denial-of-service condition. Improper bounds checking\nof an unsigned variable results in an out-of-bounds read which causes a\ncrash. Special thanks to Daehui Chang and Fady Othman for helping identify\nthe ARJ parsing vulnerability (CVE-2020-3327).\n\nFixed a vulnerability in the PDF-parsing module in ClamAV 0.101 - 0.102.2\nthat could cause a denial-of-service condition. Improper size checking of\na buffer used to initialize AES decryption routines results in an\nout-of-bounds read, which may cause a crash. OSS-Fuzz discovered this\nvulnerability (CVE-2020-3341)\n","status":"published","published":"2020-05-24T18:04:47Z","modified":"2026-04-16T04:44:18.728583074Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:2268-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nclamav was updated to the new major release 0.103.0. (jsc#ECO-3010,bsc#1118459)\n\nNote that libclamav was changed incompatible, if you have a 3rd party\napplication that uses libclamav, it needs to be rebuilt.\n\nUpdate to 0.103.0\n\n* clamd can now reload the signature database without blocking\n  scanning. This multi-threaded database reload improvement was made\n  possible thanks to a community effort.\n\n  - Non-blocking database reloads are now the default behavior. Some\n    systems that are more constrained on RAM may need to disable\n    non-blocking reloads as it will temporarily consume two times as\n     much memory. We added a new clamd config option\n    ConcurrentDatabaseReload, which may be set to no.\n\n  * Fix clamav-milter.service (requires clamd.service to run)\n\nUpdate to 0.102.4\n\n  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could\n    replace a scan target's directory with a symlink to another path\n    to trick clamscan, clamdscan, or clamonacc into removing or moving\n    a different file (eg. a critical system file). The issue would\n    affect users that use the --move or --remove options for clamscan,\n    clamdscan, and clamonacc.\n  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n    module in ClamAV 0.102.3 that could cause a Denial-of-Service\n    (DoS) condition. Improper bounds checking results in an\n    out-of-bounds read which could cause a crash. The previous fix for\n    this CVE in 0.102.3 was incomplete. This fix correctly resolves\n    the issue.\n  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in\n    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)\n    condition. Improper error handling may result in a crash due to a\n    NULL pointer dereference. This vulnerability is mitigated for\n    those using the official ClamAV signature databases because the\n    file type signatures in daily.cvd will not enable the EGG archive\n    parser in versions affected by the vulnerability.\n\nUpdate to 0.102.3\n\n  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)\n    condition. Improper bounds checking of an unsigned variable results\n    in an out-of-bounds read which causes a crash.\n  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in\n    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)\n    condition. Improper size checking of a buffer used to initialize AES\n    decryption routines results in an out-of-bounds read which may cause\n    a crash.\n  * Fix 'Attempt to allocate 0 bytes' error when parsing some PDF\n    documents.\n  * Fix a couple of minor memory leaks.\n  * Updated libclamunrar to UnRAR 5.9.2.\n\nUpdate to 0.102.2:\n\n  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when\n    using the optional credit card data-loss-prevention (DLP) feature.\n    Improper bounds checking of an unsigned variable resulted in an\n    out-of-bounds read, which causes a crash.\n  * Significantly improved the scan speed of PDF files on Windows.\n  * Re-applied a fix to alleviate file access issues when scanning RAR\n    files in downstream projects that use libclamav where the scanning\n    engine is operating in a low-privilege process. This bug was originally\n    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.\n  * Fixed an issue where freshclam failed to update if the database version\n    downloaded is one version older than advertised. This situation may\n    occur after a new database version is published. The issue affected\n    users downloading the whole CVD database file.\n  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).\n    The ReceiveTimeout had caused needless database update failures for\n    users with slower internet connections.\n  * Correctly display the number of kilobytes (KiB) in progress bar and\n    reduced the size of the progress bar to accommodate 80-character width\n    terminals.\n  * Fixed an issue where running freshclam manually causes a daemonized\n    freshclam process to fail when it updates because the manual instance\n    deletes the temporary download directory. The freshclam temporary files\n    will now download to a unique directory created at the time of an update\n    instead of using a hardcoded directory created/destroyed at the program\n    start/exit.\n  * Fix for freshclam's OnOutdatedExecute config option.\n  * Fixes a memory leak in the error condition handling for the email\n    parser.\n  * Improved bound checking and error handling in ARJ archive parser.\n  * Improved error handling in PDF parser.\n  * Fix for memory leak in byte-compare signature handler.\n\n- The freshclam.service should not be started before the network is\n  online (it checks for updates immediately upon service start)\n\nUpdate to 0.102.1:\n\n  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)\n    vulnerability may occur when scanning a specially crafted email\n    file as a result of excessively long scan times. The issue is\n    resolved by implementing several maximums in parsing MIME\n    messages and by optimizing use of memory allocation.\n  * Build system fixes to build clamav-milter, to correctly link\n    with libxml2 when detected, and to correctly detect fanotify\n    for on-access scanning feature support.\n  * Signature load time is significantly reduced by changing to a\n    more efficient algorithm for loading signature patterns and\n    allocating the AC trie. Patch courtesy of Alberto Wu.\n  * Introduced a new configure option to statically link libjson-c\n    with libclamav. Static linking with libjson is highly\n    recommended to prevent crashes in applications that use\n    libclamav alongside another JSON parsing library.\n  * Null-dereference fix in email parser when using the\n    --gen-json metadata option.\n  * Fixes for Authenticode parsing and certificate signature\n    (.crb database) bugs.\n\nUpdate to 0.102.0:\n\n  * The On-Access Scanning feature has been migrated out of clamd\n    and into a brand new utility named clamonacc. This utility is\n    similar to clamdscan and clamav-milter in that it acts as a\n    client to clamd. This separation from clamd means that clamd no\n    longer needs to run with root privileges while scanning potentially\n    malicious files. Instead, clamd may drop privileges to run under an\n    account that does not have super-user. In addition to improving the\n    security posture of running clamd with On-Access enabled, this\n    update fixed a few outstanding defects:\n    - On-Access scanning for created and moved files (Extra-Scanning)\n      is fixed.\n    - VirusEvent for On-Access scans is fixed.\n    - With clamonacc, it is now possible to copy, move, or remove a\n      file if the scan triggered an alert, just like with clamdscan.\n  * The freshclam database update utility has undergone a significant\n    update. This includes:\n    - Added support for HTTPS.\n    - Support for database mirrors hosted on ports other than 80.\n    - Removal of the mirror management feature (mirrors.dat).\n    - An all new libfreshclam library API.\n- created new subpackage libfreshclam2\n\nUpdate to 0.101.4:\n\n  * CVE-2019-12900: An out of bounds write in the NSIS bzip2\n    (bsc#1149458)\n  * CVE-2019-12625: Introduce a configurable time limit to mitigate\n    zip bomb vulnerability completely. Default is 2 minutes,\n    configurable useing the clamscan --max-scantime and for clamd\n    using the MaxScanTime config option (bsc#1144504)\n\nUpdate to version 0.101.3:\n\n  * bsc#1144504: ZIP bomb causes extreme CPU spikes\n\nUpdate to version 0.101.2 (bsc#1130721)\n\n  * CVE-2019-1787:\n    An out-of-bounds heap read condition may occur when scanning PDF\n    documents. The defect is a failure to correctly keep track of the number\n    of bytes remaining in a buffer when indexing file data.\n  * CVE-2019-1789:\n    An out-of-bounds heap read condition may occur when scanning PE files\n    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a\n    result of inadequate bound-checking.\n  * CVE-2019-1788:\n    An out-of-bounds heap write condition may occur when scanning OLE2 files\n    such as Microsoft Office 97-2003 documents. The invalid write happens when\n    an invalid pointer is mistakenly used to initialize a 32bit integer to\n    zero. This is likely to crash the application.\n  * CVE-2019-1786:\n    An out-of-bounds heap read condition may occur when scanning malformed\n    PDF documents as a result of improper bounds-checking.\n  * CVE-2019-1785:\n    A path-traversal write condition may occur as a result of improper\n    input validation when scanning RAR archives.\n  * CVE-2019-1798:\n    A use-after-free condition may occur as a result of improper error\n    handling when scanning nested RAR archives.\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-12-17T15:24:14Z","modified":"2026-02-04T04:37:19.746735Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:2276-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nclamav was updated to the new major release 0.103.0. (jsc#ECO-3010,bsc#1118459)\n\nNote that libclamav was changed incompatible, if you have a 3rd party\napplication that uses libclamav, it needs to be rebuilt.\n\nUpdate to 0.103.0\n\n* clamd can now reload the signature database without blocking\n  scanning. This multi-threaded database reload improvement was made\n  possible thanks to a community effort.\n\n  - Non-blocking database reloads are now the default behavior. Some\n    systems that are more constrained on RAM may need to disable\n    non-blocking reloads as it will temporarily consume two times as\n     much memory. We added a new clamd config option\n    ConcurrentDatabaseReload, which may be set to no.\n\n  * Fix clamav-milter.service (requires clamd.service to run)\n\nUpdate to 0.102.4\n\n  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could\n    replace a scan target's directory with a symlink to another path\n    to trick clamscan, clamdscan, or clamonacc into removing or moving\n    a different file (eg. a critical system file). The issue would\n    affect users that use the --move or --remove options for clamscan,\n    clamdscan, and clamonacc.\n  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n    module in ClamAV 0.102.3 that could cause a Denial-of-Service\n    (DoS) condition. Improper bounds checking results in an\n    out-of-bounds read which could cause a crash. The previous fix for\n    this CVE in 0.102.3 was incomplete. This fix correctly resolves\n    the issue.\n  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in\n    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)\n    condition. Improper error handling may result in a crash due to a\n    NULL pointer dereference. This vulnerability is mitigated for\n    those using the official ClamAV signature databases because the\n    file type signatures in daily.cvd will not enable the EGG archive\n    parser in versions affected by the vulnerability.\n\nUpdate to 0.102.3\n\n  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)\n    condition. Improper bounds checking of an unsigned variable results\n    in an out-of-bounds read which causes a crash.\n  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in\n    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)\n    condition. Improper size checking of a buffer used to initialize AES\n    decryption routines results in an out-of-bounds read which may cause\n    a crash.\n  * Fix 'Attempt to allocate 0 bytes' error when parsing some PDF\n    documents.\n  * Fix a couple of minor memory leaks.\n  * Updated libclamunrar to UnRAR 5.9.2.\n\nUpdate to 0.102.2:\n\n  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when\n    using the optional credit card data-loss-prevention (DLP) feature.\n    Improper bounds checking of an unsigned variable resulted in an\n    out-of-bounds read, which causes a crash.\n  * Significantly improved the scan speed of PDF files on Windows.\n  * Re-applied a fix to alleviate file access issues when scanning RAR\n    files in downstream projects that use libclamav where the scanning\n    engine is operating in a low-privilege process. This bug was originally\n    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.\n  * Fixed an issue where freshclam failed to update if the database version\n    downloaded is one version older than advertised. This situation may\n    occur after a new database version is published. The issue affected\n    users downloading the whole CVD database file.\n  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).\n    The ReceiveTimeout had caused needless database update failures for\n    users with slower internet connections.\n  * Correctly display the number of kilobytes (KiB) in progress bar and\n    reduced the size of the progress bar to accommodate 80-character width\n    terminals.\n  * Fixed an issue where running freshclam manually causes a daemonized\n    freshclam process to fail when it updates because the manual instance\n    deletes the temporary download directory. The freshclam temporary files\n    will now download to a unique directory created at the time of an update\n    instead of using a hardcoded directory created/destroyed at the program\n    start/exit.\n  * Fix for freshclam's OnOutdatedExecute config option.\n  * Fixes a memory leak in the error condition handling for the email\n    parser.\n  * Improved bound checking and error handling in ARJ archive parser.\n  * Improved error handling in PDF parser.\n  * Fix for memory leak in byte-compare signature handler.\n\n- The freshclam.service should not be started before the network is\n  online (it checks for updates immediately upon service start)\n\nUpdate to 0.102.1:\n\n  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)\n    vulnerability may occur when scanning a specially crafted email\n    file as a result of excessively long scan times. The issue is\n    resolved by implementing several maximums in parsing MIME\n    messages and by optimizing use of memory allocation.\n  * Build system fixes to build clamav-milter, to correctly link\n    with libxml2 when detected, and to correctly detect fanotify\n    for on-access scanning feature support.\n  * Signature load time is significantly reduced by changing to a\n    more efficient algorithm for loading signature patterns and\n    allocating the AC trie. Patch courtesy of Alberto Wu.\n  * Introduced a new configure option to statically link libjson-c\n    with libclamav. Static linking with libjson is highly\n    recommended to prevent crashes in applications that use\n    libclamav alongside another JSON parsing library.\n  * Null-dereference fix in email parser when using the\n    --gen-json metadata option.\n  * Fixes for Authenticode parsing and certificate signature\n    (.crb database) bugs.\n\nUpdate to 0.102.0:\n\n  * The On-Access Scanning feature has been migrated out of clamd\n    and into a brand new utility named clamonacc. This utility is\n    similar to clamdscan and clamav-milter in that it acts as a\n    client to clamd. This separation from clamd means that clamd no\n    longer needs to run with root privileges while scanning potentially\n    malicious files. Instead, clamd may drop privileges to run under an\n    account that does not have super-user. In addition to improving the\n    security posture of running clamd with On-Access enabled, this\n    update fixed a few outstanding defects:\n    - On-Access scanning for created and moved files (Extra-Scanning)\n      is fixed.\n    - VirusEvent for On-Access scans is fixed.\n    - With clamonacc, it is now possible to copy, move, or remove a\n      file if the scan triggered an alert, just like with clamdscan.\n  * The freshclam database update utility has undergone a significant\n    update. This includes:\n    - Added support for HTTPS.\n    - Support for database mirrors hosted on ports other than 80.\n    - Removal of the mirror management feature (mirrors.dat).\n    - An all new libfreshclam library API.\n- created new subpackage libfreshclam2\n\nUpdate to 0.101.4:\n\n  * CVE-2019-12900: An out of bounds write in the NSIS bzip2\n    (bsc#1149458)\n  * CVE-2019-12625: Introduce a configurable time limit to mitigate\n    zip bomb vulnerability completely. Default is 2 minutes,\n    configurable useing the clamscan --max-scantime and for clamd\n    using the MaxScanTime config option (bsc#1144504)\n\nUpdate to version 0.101.3:\n\n  * bsc#1144504: ZIP bomb causes extreme CPU spikes\n\nUpdate to version 0.101.2 (bsc#1130721)\n\n  * CVE-2019-1787:\n    An out-of-bounds heap read condition may occur when scanning PDF\n    documents. The defect is a failure to correctly keep track of the number\n    of bytes remaining in a buffer when indexing file data.\n  * CVE-2019-1789:\n    An out-of-bounds heap read condition may occur when scanning PE files\n    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a\n    result of inadequate bound-checking.\n  * CVE-2019-1788:\n    An out-of-bounds heap write condition may occur when scanning OLE2 files\n    such as Microsoft Office 97-2003 documents. The invalid write happens when\n    an invalid pointer is mistakenly used to initialize a 32bit integer to\n    zero. This is likely to crash the application.\n  * CVE-2019-1786:\n    An out-of-bounds heap read condition may occur when scanning malformed\n    PDF documents as a result of improper bounds-checking.\n  * CVE-2019-1785:\n    A path-traversal write condition may occur as a result of improper\n    input validation when scanning RAR archives.\n  * CVE-2019-1798:\n    A use-after-free condition may occur as a result of improper error\n    handling when scanning nested RAR archives.\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-12-18T05:23:57Z","modified":"2026-02-04T04:37:31.568418Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10685-1","title":"clamav-0.103.3-1.4 on GA media","description":"These are all security issues fixed in the clamav-0.103.3-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:59.666103Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:3729-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nclamav was updated to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459.\n\n* clamd can now reload the signature database without blocking\n  scanning. This multi-threaded database reload improvement was made\n  possible thanks to a community effort.\n  - Non-blocking database reloads are now the default behavior. Some\n    systems that are more constrained on RAM may need to disable\n    non-blocking reloads as it will temporarily consume two times as\n    much memory. We added a new clamd config option\n    ConcurrentDatabaseReload, which may be set to no.\n* Fix clamav-milter.service (requires clamd.service to run)\n* Fix freshclam crash in FIPS mode. (bsc#1119353)\n\nUpdate to version 0.102.4:\n\nAccumulated security fixes:\n\n* CVE-2020-3350: Fix a vulnerability wherein a malicious user could\n  replace a scan target's directory with a symlink to another path\n  to trick clamscan, clamdscan, or clamonacc into removing or moving\n  a different file (eg. a critical system file). The issue would\n  affect users that use the --move or --remove options for clamscan,\n  clamdscan, and clamonacc. (bsc#1174255)\n* CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n  module in ClamAV 0.102.3 that could cause a Denial-of-Service\n  (DoS) condition. Improper bounds checking results in an\n  out-of-bounds read which could cause a crash. The previous fix for\n  this CVE in 0.102.3 was incomplete. This fix correctly resolves\n  the issue.\n* CVE-2020-3481: Fix a vulnerability in the EGG archive module in\n  ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)\n  condition. Improper error handling may result in a crash due to a\n  NULL pointer dereference. This vulnerability is mitigated for\n  those using the official ClamAV signature databases because the\n  file type signatures in daily.cvd will not enable the EGG archive\n  parser in versions affected by the vulnerability. (bsc#1174250)\n* CVE-2020-3341: Fix a vulnerability in the PDF parsing module in\n  ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)\n  condition. Improper size checking of a buffer used to initialize AES\n  decryption routines results in an out-of-bounds read which may cause\n  a crash. (bsc#1171981)\n* CVE-2020-3123: A denial-of-service (DoS) condition may occur when\n  using the optional credit card data-loss-prevention (DLP) feature.\n  Improper bounds checking of an unsigned variable resulted in an\n  out-of-bounds read, which causes a crash.\n* CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may\n  occur when scanning a specially crafted email file as a result\n  of excessively long scan times. The issue is resolved by\n  implementing several maximums in parsing MIME messages and by\n  optimizing use of memory allocation. (bsc#1157763).\n* CVE-2019-12900: An out of bounds write in the NSIS bzip2\n  (bsc#1149458)\n* CVE-2019-12625: Introduce a configurable time limit to mitigate\n  zip bomb vulnerability completely. Default is 2 minutes,\n  configurable useing the clamscan --max-scantime and for clamd\n  using the MaxScanTime config option (bsc#1144504)\n\n- Increase the startup timeout of clamd to 5 minutes\n  to cater for the grown virus database as a workaround until\n  clamd has learned to talk to systemd to extend the timeout as\n  long as needed. (bsc#1151839)\n","status":"published","published":"2020-12-09T13:44:57Z","modified":"2026-02-04T02:52:39.918703Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3790-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nclamav was updated to the new major release 0.103.0. (jsc#ECO-3010,bsc#1118459)\n\nNote that libclamav was changed incompatible, if you have a 3rd party\napplication that uses libclamav, it needs to be rebuilt.\n\nUpdate to 0.103.0\n\n* clamd can now reload the signature database without blocking\n  scanning. This multi-threaded database reload improvement was made\n  possible thanks to a community effort.\n\n  - Non-blocking database reloads are now the default behavior. Some\n    systems that are more constrained on RAM may need to disable\n    non-blocking reloads as it will temporarily consume two times as\n     much memory. We added a new clamd config option\n    ConcurrentDatabaseReload, which may be set to no.\n\n  * Fix clamav-milter.service (requires clamd.service to run)\n\nUpdate to 0.102.4\n\n  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could\n    replace a scan target's directory with a symlink to another path\n    to trick clamscan, clamdscan, or clamonacc into removing or moving\n    a different file (eg. a critical system file). The issue would\n    affect users that use the --move or --remove options for clamscan,\n    clamdscan, and clamonacc.\n  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n    module in ClamAV 0.102.3 that could cause a Denial-of-Service\n    (DoS) condition. Improper bounds checking results in an\n    out-of-bounds read which could cause a crash. The previous fix for\n    this CVE in 0.102.3 was incomplete. This fix correctly resolves\n    the issue.\n  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in\n    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)\n    condition. Improper error handling may result in a crash due to a\n    NULL pointer dereference. This vulnerability is mitigated for\n    those using the official ClamAV signature databases because the\n    file type signatures in daily.cvd will not enable the EGG archive\n    parser in versions affected by the vulnerability.\n\nUpdate to 0.102.3\n\n  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)\n    condition. Improper bounds checking of an unsigned variable results\n    in an out-of-bounds read which causes a crash.\n  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in\n    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)\n    condition. Improper size checking of a buffer used to initialize AES\n    decryption routines results in an out-of-bounds read which may cause\n    a crash.\n  * Fix 'Attempt to allocate 0 bytes' error when parsing some PDF\n    documents.\n  * Fix a couple of minor memory leaks.\n  * Updated libclamunrar to UnRAR 5.9.2.\n\nUpdate to 0.102.2:\n\n  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when\n    using the optional credit card data-loss-prevention (DLP) feature.\n    Improper bounds checking of an unsigned variable resulted in an\n    out-of-bounds read, which causes a crash.\n  * Significantly improved the scan speed of PDF files on Windows.\n  * Re-applied a fix to alleviate file access issues when scanning RAR\n    files in downstream projects that use libclamav where the scanning\n    engine is operating in a low-privilege process. This bug was originally\n    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.\n  * Fixed an issue where freshclam failed to update if the database version\n    downloaded is one version older than advertised. This situation may\n    occur after a new database version is published. The issue affected\n    users downloading the whole CVD database file.\n  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).\n    The ReceiveTimeout had caused needless database update failures for\n    users with slower internet connections.\n  * Correctly display the number of kilobytes (KiB) in progress bar and\n    reduced the size of the progress bar to accommodate 80-character width\n    terminals.\n  * Fixed an issue where running freshclam manually causes a daemonized\n    freshclam process to fail when it updates because the manual instance\n    deletes the temporary download directory. The freshclam temporary files\n    will now download to a unique directory created at the time of an update\n    instead of using a hardcoded directory created/destroyed at the program\n    start/exit.\n  * Fix for freshclam's OnOutdatedExecute config option.\n  * Fixes a memory leak in the error condition handling for the email\n    parser.\n  * Improved bound checking and error handling in ARJ archive parser.\n  * Improved error handling in PDF parser.\n  * Fix for memory leak in byte-compare signature handler.\n\n- The freshclam.service should not be started before the network is\n  online (it checks for updates immediately upon service start)\n\nUpdate to 0.102.1:\n\n  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)\n    vulnerability may occur when scanning a specially crafted email\n    file as a result of excessively long scan times. The issue is\n    resolved by implementing several maximums in parsing MIME\n    messages and by optimizing use of memory allocation.\n  * Build system fixes to build clamav-milter, to correctly link\n    with libxml2 when detected, and to correctly detect fanotify\n    for on-access scanning feature support.\n  * Signature load time is significantly reduced by changing to a\n    more efficient algorithm for loading signature patterns and\n    allocating the AC trie. Patch courtesy of Alberto Wu.\n  * Introduced a new configure option to statically link libjson-c\n    with libclamav. Static linking with libjson is highly\n    recommended to prevent crashes in applications that use\n    libclamav alongside another JSON parsing library.\n  * Null-dereference fix in email parser when using the\n    --gen-json metadata option.\n  * Fixes for Authenticode parsing and certificate signature\n    (.crb database) bugs.\n\nUpdate to 0.102.0:\n\n  * The On-Access Scanning feature has been migrated out of clamd\n    and into a brand new utility named clamonacc. This utility is\n    similar to clamdscan and clamav-milter in that it acts as a\n    client to clamd. This separation from clamd means that clamd no\n    longer needs to run with root privileges while scanning potentially\n    malicious files. Instead, clamd may drop privileges to run under an\n    account that does not have super-user. In addition to improving the\n    security posture of running clamd with On-Access enabled, this\n    update fixed a few outstanding defects:\n    - On-Access scanning for created and moved files (Extra-Scanning)\n      is fixed.\n    - VirusEvent for On-Access scans is fixed.\n    - With clamonacc, it is now possible to copy, move, or remove a\n      file if the scan triggered an alert, just like with clamdscan.\n  * The freshclam database update utility has undergone a significant\n    update. This includes:\n    - Added support for HTTPS.\n    - Support for database mirrors hosted on ports other than 80.\n    - Removal of the mirror management feature (mirrors.dat).\n    - An all new libfreshclam library API.\n- created new subpackage libfreshclam2\n\nUpdate to 0.101.4:\n\n  * CVE-2019-12900: An out of bounds write in the NSIS bzip2\n    (bsc#1149458)\n  * CVE-2019-12625: Introduce a configurable time limit to mitigate\n    zip bomb vulnerability completely. Default is 2 minutes,\n    configurable useing the clamscan --max-scantime and for clamd\n    using the MaxScanTime config option (bsc#1144504)\n\nUpdate to version 0.101.3:\n\n  * bsc#1144504: ZIP bomb causes extreme CPU spikes\n\nUpdate to version 0.101.2 (bsc#1130721)\n\n  * CVE-2019-1787:\n    An out-of-bounds heap read condition may occur when scanning PDF\n    documents. The defect is a failure to correctly keep track of the number\n    of bytes remaining in a buffer when indexing file data.\n  * CVE-2019-1789:\n    An out-of-bounds heap read condition may occur when scanning PE files\n    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a\n    result of inadequate bound-checking.\n  * CVE-2019-1788:\n    An out-of-bounds heap write condition may occur when scanning OLE2 files\n    such as Microsoft Office 97-2003 documents. The invalid write happens when\n    an invalid pointer is mistakenly used to initialize a 32bit integer to\n    zero. This is likely to crash the application.\n  * CVE-2019-1786:\n    An out-of-bounds heap read condition may occur when scanning malformed\n    PDF documents as a result of improper bounds-checking.\n  * CVE-2019-1785:\n    A path-traversal write condition may occur as a result of improper\n    input validation when scanning RAR archives.\n  * CVE-2019-1798:\n    A use-after-free condition may occur as a result of improper error\n    handling when scanning nested RAR archives.\n","status":"published","published":"2020-12-14T14:01:32Z","modified":"2026-02-04T04:00:40.474608Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3918-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nclamav was updated to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459.\n\n* clamd can now reload the signature database without blocking\n  scanning. This multi-threaded database reload improvement was made\n  possible thanks to a community effort.\n  - Non-blocking database reloads are now the default behavior. Some\n    systems that are more constrained on RAM may need to disable\n    non-blocking reloads as it will temporarily consume two times as\n    much memory. We added a new clamd config option\n    ConcurrentDatabaseReload, which may be set to no.\n* Fix clamav-milter.service (requires clamd.service to run)\n* bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.\n* Partial sync with SLE15.\n\nUpdate to version 0.102.4\n\nAccumulated security fixes:\n\n* CVE-2020-3350: Fix a vulnerability wherein a malicious user could\n  replace a scan target's directory with a symlink to another path\n  to trick clamscan, clamdscan, or clamonacc into removing or moving\n  a different file (eg. a critical system file). The issue would\n  affect users that use the --move or --remove options for clamscan,\n  clamdscan, and clamonacc. (bsc#1174255)\n* CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n  module in ClamAV 0.102.3 that could cause a Denial-of-Service\n  (DoS) condition. Improper bounds checking results in an\n  out-of-bounds read which could cause a crash. The previous fix for\n  this CVE in 0.102.3 was incomplete. This fix correctly resolves\n  the issue.\n* CVE-2020-3481: Fix a vulnerability in the EGG archive module in\n  ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)\n  condition. Improper error handling may result in a crash due to a\n  NULL pointer dereference. This vulnerability is mitigated for\n  those using the official ClamAV signature databases because the\n  file type signatures in daily.cvd will not enable the EGG archive\n  parser in versions affected by the vulnerability. (bsc#1174250)\n* CVE-2020-3341: Fix a vulnerability in the PDF parsing module in\n  ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)\n  condition. Improper size checking of a buffer used to initialize AES\n  decryption routines results in an out-of-bounds read which may cause\n  a crash. (bsc#1171981)\n* CVE-2020-3123: A denial-of-service (DoS) condition may occur when\n  using the optional credit card data-loss-prevention (DLP) feature.\n  Improper bounds checking of an unsigned variable resulted in an\n  out-of-bounds read, which causes a crash.\n* CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may\n  occur when scanning a specially crafted email file as a result\n  of excessively long scan times. The issue is resolved by\n  implementing several maximums in parsing MIME messages and by\n  optimizing use of memory allocation. (bsc#1157763).\n* CVE-2019-12900: An out of bounds write in the NSIS bzip2\n  (bsc#1149458)\n* CVE-2019-12625: Introduce a configurable time limit to mitigate\n  zip bomb vulnerability completely. Default is 2 minutes,\n  configurable useing the clamscan --max-scantime and for clamd\n  using the MaxScanTime config option (bsc#1144504)\n\nUpdate to version 0.101.3:\n\n* ZIP bomb causes extreme CPU spikes (bsc#1144504)\n\nUpdate to version 0.101.2 (bsc#1118459):\n\n* Support for RAR v5 archive extraction.\n* Incompatible changes to the arguments of cl_scandesc,\n  cl_scandesc_callback, and cl_scanmap_callback.\n* Scanning options have been converted from a single flag\n  bit-field into a structure of multiple categorized flag\n  bit-fields.\n* The CL_SCAN_HEURISTIC_ENCRYPTED scan option was replaced by\n  2 new scan options: CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE, and\n  CL_SCAN_HEURISTIC_ENCRYPTED_DOC\n* Incompatible clamd.conf and command line interface changes.\n* Heuristic Alerts' (aka 'Algorithmic Detection') options have\n  been changed to make the names more consistent. The original\n  options are deprecated in 0.101, and will be removed in a\n  future feature release.\n* For details, see https://blog.clamav.net/2018/12/clamav-01010-has-been-released.html","status":"published","published":"2020-12-22T13:18:28Z","modified":"2026-02-04T02:26:54.415234Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:14592-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\n- Update to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459\n- This update incorporates incompatible changes that were introduced\n  in version 0.101.0.\n- Accumulated security fixes:\n  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could\n    replace a scan target's directory with a symlink to another path\n    to trick clamscan, clamdscan, or clamonacc into removing or moving\n    a different file (eg. a critical system file). The issue would\n    affect users that use the --move or --remove options for clamscan,\n    clamdscan, and clamonacc. (bsc#1174255)\n  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing\n    module in ClamAV 0.102.3 that could cause a Denial-of-Service\n    (DoS) condition. Improper bounds checking results in an\n    out-of-bounds read which could cause a crash. The previous fix for\n    this CVE in 0.102.3 was incomplete. This fix correctly resolves\n    the issue.\n  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in\n    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)\n    condition. Improper error handling may result in a crash due to a\n    NULL pointer dereference. This vulnerability is mitigated for\n    those using the official ClamAV signature databases because the\n    file type signatures in daily.cvd will not enable the EGG archive\n    parser in versions affected by the vulnerability. (bsc#1174250)\n  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in\n    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)\n    condition. Improper size checking of a buffer used to initialize AES\n    decryption routines results in an out-of-bounds read which may cause\n    a crash. (bsc#1171981)\n  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when\n    using the optional credit card data-loss-prevention (DLP) feature.\n    Improper bounds checking of an unsigned variable resulted in an\n    out-of-bounds read, which causes a crash.\n","status":"published","published":"2021-01-05T16:32:30Z","modified":"2026-02-04T02:44:05.659464Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4370-1","title":"clamav vulnerabilities","description":"It was discovered that ClamAV incorrectly handled parsing ARJ archives. A\nremote attacker could possibly use this issue to cause ClamAV to crash,\nresulting in a denial of service. (CVE-2020-3327)\n\nIt was discovered that ClamAV incorrectly handled parsing PDF files. A\nremote attacker could possibly use this issue to cause ClamAV to crash,\nresulting in a denial of service. (CVE-2020-3341)\n","status":"published","published":"2020-05-21T16:43:21Z","modified":"2026-04-22T10:05:34.161613Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4370-2","title":"clamav vulnerabilities","description":"USN-4370-1 fixed several vulnerabilities in ClamAV. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that ClamAV incorrectly handled parsing ARJ archives. A\n remote attacker could possibly use this issue to cause ClamAV to crash,\n resulting in a denial of service. (CVE-2020-3327)\n\n It was discovered that ClamAV incorrectly handled parsing PDF files. A\n remote attacker could possibly use this issue to cause ClamAV to crash,\n resulting in a denial of service. (CVE-2020-3341)\n","status":"published","published":"2020-05-21T18:47:19Z","modified":"2026-04-22T10:04:45.62351Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}