{"id":"CVE-2022-20770","aliases":["ALPINE-CVE-2022-20770","AZL-9666","DEBIAN-CVE-2022-20770","DLA-3042-1","EUVD-2022-26020","GHSA-5443-gj53-cw56","MGASA-2022-0187","OESA-2022-1683","SUSE-SU-2022:1644-1","SUSE-SU-2022:1647-1","UBUNTU-CVE-2022-20770","USN-5423-1","USN-5423-2","openSUSE-SU-2024:12047-1"],"status":"published","title":"ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.07074,"percentile":0.94261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2022-05-04T17:05:29Z","modified":"2026-11-03T08:02:09Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"clamav","fixed_in":["0.103.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"clamav","fixed_in":["0.103.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"clamav","fixed_in":["0.105.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"clamav","fixed_in":["0.103.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"clamav","fixed_in":["0.103.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"clamav","fixed_in":["0.103.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.104.0"},{"fixed":"0.103.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.104.0"},{"fixed":"0.103.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0+deb9u1"}]}],"versions":["0.100.0+dfsg-0+deb9u1","0.100.0+dfsg-0+deb9u2","0.100.0+dfsg-1","0.100.0~beta+dfsg-1","0.100.0~beta+dfsg-2","0.100.1+dfsg-0+deb9u1","0.100.1+dfsg-1","0.100.2+dfsg-0+deb9u1","0.100.2+dfsg-1","0.100.2+dfsg-2","0.100.3+dfsg-0+deb9u1","0.101.0+dfsg-1","0.101.1+dfsg-1","0.101.1+dfsg-2","0.101.1+dfsg-3","0.101.2+dfsg-0+deb9u1","0.101.2+dfsg-1","0.101.2+dfsg-2","0.101.2+dfsg-3","0.101.4+dfsg-0+deb9u1","0.101.4+dfsg-1","0.102.1+dfsg-0+deb9u1","0.102.1+dfsg-0+deb9u2","0.102.1+dfsg-1","0.102.1+dfsg-2","0.102.1+dfsg-3","0.102.2+dfsg-0~deb9u1","0.102.2+dfsg-1","0.102.2+dfsg-2","0.102.3+dfsg-0~deb9u1","0.102.3+dfsg-1","0.102.4+dfsg-0+deb9u1","0.102.4+dfsg-0+deb9u2","0.102.4+dfsg-1","0.103.0+dfsg-1","0.103.0+dfsg-2","0.103.0+dfsg-3","0.103.0+dfsg-3.1","0.103.2+dfsg-1","0.103.2+dfsg-2","0.103.3+dfsg-1","0.103.4+dfsg-0+deb9u1","0.103.4+dfsg-1","0.103.5+dfsg-1","0.99.2+dfsg-6","0.99.2+dfsg-6+deb9u1","0.99.3~beta1+dfsg-1","0.99.3~beta1+dfsg-2","0.99.3~beta1+dfsg-3","0.99.3~beta1+dfsg-4","0.99.3~beta2+dfsg-1","0.99.3~snapshot20170704+dfsg-1","0.99.4+dfsg-1+deb9u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:8","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-1.mga8"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-3.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-3.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-3.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.14.04.1+esm1"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3","0.100.1+dfsg-1ubuntu0.14.04.4","0.100.2+dfsg-1ubuntu0.14.04.1","0.100.2+dfsg-1ubuntu0.14.04.2","0.100.3+dfsg-0ubuntu0.14.04.1","0.100.3+dfsg-0ubuntu0.14.04.1+esm1","0.101.4+dfsg-0ubuntu0.14.04.1+esm1","0.102.1+dfsg-0ubuntu0.14.04.1+esm1","0.102.2+dfsg-0ubuntu0.14.04.1+esm1","0.102.3+dfsg-0ubuntu0.14.04.1+esm1","0.102.4+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm2","0.103.5+dfsg-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.16.04.1+esm1"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2","0.100.1+dfsg-1ubuntu0.16.04.3","0.100.2+dfsg-1ubuntu0.16.04.1","0.100.3+dfsg-0ubuntu0.16.04.1","0.101.4+dfsg-0ubuntu0.16.04.1","0.102.1+dfsg-0ubuntu0.16.04.2","0.102.2+dfsg-0ubuntu0.16.04.1","0.102.3+dfsg-0ubuntu0.16.04.1","0.102.4+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1+esm1","0.103.5+dfsg-0ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.18.04.1"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2","0.100.1+dfsg-1ubuntu0.18.04.3","0.100.2+dfsg-1ubuntu0.18.04.1","0.100.3+dfsg-0ubuntu0.18.04.1","0.101.4+dfsg-0ubuntu0.18.04.1","0.102.1+dfsg-0ubuntu0.18.04.2","0.102.2+dfsg-0ubuntu0.18.04.1","0.102.3+dfsg-0ubuntu0.18.04.1","0.102.4+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.2","0.103.2+dfsg-0ubuntu0.18.04.3","0.103.5+dfsg-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.20.04.1"}]}],"versions":["0.101.4+dfsg-1ubuntu1","0.102.1+dfsg-1ubuntu1","0.102.1+dfsg-2ubuntu1","0.102.1+dfsg-2ubuntu2","0.102.2+dfsg-1ubuntu1","0.102.2+dfsg-2ubuntu1","0.102.3+dfsg-0ubuntu0.20.04.1","0.102.4+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.2","0.103.5+dfsg-1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.22.04.1"}]}],"versions":["0.103.3+dfsg-1","0.103.4+dfsg-1","0.103.4+dfsg-1build1","0.103.5+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.18.04.1"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2","0.100.1+dfsg-1ubuntu0.18.04.3","0.100.2+dfsg-1ubuntu0.18.04.1","0.100.3+dfsg-0ubuntu0.18.04.1","0.101.4+dfsg-0ubuntu0.18.04.1","0.102.1+dfsg-0ubuntu0.18.04.2","0.102.2+dfsg-0ubuntu0.18.04.1","0.102.3+dfsg-0ubuntu0.18.04.1","0.102.4+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.2","0.103.2+dfsg-0ubuntu0.18.04.3","0.103.5+dfsg-0ubuntu0.18.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.20.04.1"}]}],"versions":["0.101.4+dfsg-1ubuntu1","0.102.1+dfsg-1ubuntu1","0.102.1+dfsg-2ubuntu1","0.102.1+dfsg-2ubuntu2","0.102.2+dfsg-1ubuntu1","0.102.2+dfsg-2ubuntu1","0.102.3+dfsg-0ubuntu0.20.04.1","0.102.4+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.2","0.103.5+dfsg-1~20.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.22.04.1"}]}],"versions":["0.103.3+dfsg-1","0.103.4+dfsg-1","0.103.4+dfsg-1build1","0.103.5+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.14.04.1+esm1"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3","0.100.1+dfsg-1ubuntu0.14.04.4","0.100.2+dfsg-1ubuntu0.14.04.1","0.100.2+dfsg-1ubuntu0.14.04.2","0.100.3+dfsg-0ubuntu0.14.04.1","0.100.3+dfsg-0ubuntu0.14.04.1+esm1","0.101.4+dfsg-0ubuntu0.14.04.1+esm1","0.102.1+dfsg-0ubuntu0.14.04.1+esm1","0.102.2+dfsg-0ubuntu0.14.04.1+esm1","0.102.3+dfsg-0ubuntu0.14.04.1+esm1","0.102.4+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm2","0.103.5+dfsg-0ubuntu0.14.04.1+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.16.04.1+esm1"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2","0.100.1+dfsg-1ubuntu0.16.04.3","0.100.2+dfsg-1ubuntu0.16.04.1","0.100.3+dfsg-0ubuntu0.16.04.1","0.101.4+dfsg-0ubuntu0.16.04.1","0.102.1+dfsg-0ubuntu0.16.04.2","0.102.2+dfsg-0ubuntu0.16.04.1","0.102.3+dfsg-0ubuntu0.16.04.1","0.102.4+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1+esm1","0.103.5+dfsg-0ubuntu0.16.04.1+esm1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-1.1"}]}],"bundled":5}],"products":[{"vendor":"cisco","product":"cisco amp for endpoints"},{"vendor":"cisco","product":"secure_endpoint"},{"vendor":"clamav","product":"clamav"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-prVGcHLd","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RV6BLIATIJE74SQ6NG5ZC4JK5MMDQ2R/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4NNBIJVG6Z4PDIKUZXTYXICYUAYAZ56/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BX5ZXNHP4NFYQ5BFSKY3WT7NTBZUYG7L/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00004.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202310-01","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20770","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RV6BLIATIJE74SQ6NG5ZC4JK5MMDQ2R/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BX5ZXNHP4NFYQ5BFSKY3WT7NTBZUYG7L/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N4NNBIJVG6Z4PDIKUZXTYXICYUAYAZ56/"},{"url":"https://github.com/advisories/GHSA-5443-gj53-cw56"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-20770","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-20770","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0187.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30417","tags":["report"]},{"url":"https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html","tags":["web","report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221647-1/","tags":["web","advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OQIRF7L5ZKGSRUC6DDORCDJYKMVJMCEB/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20792","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221644-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199242","tags":["report"]},{"url":"https://bugzilla.suse.com/1199244","tags":["report"]},{"url":"https://bugzilla.suse.com/1199245","tags":["report"]},{"url":"https://bugzilla.suse.com/1199246","tags":["report"]},{"url":"https://bugzilla.suse.com/1199274","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20796","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-20770","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5423-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5423-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20796","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-20770","title":"ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:05:29.271Z","modified":"2024-11-06T16:16:53.85Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:34:24.627322Z"}],"euvd":[{"id":"EUVD-2022-26020","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:05:29Z","modified":"2024-11-06T16:16:53Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:05:09.633391Z"}],"ghsa":[{"id":"GHSA-5443-gj53-cw56","title":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5...","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-05T00:00:18Z","modified":"2023-10-10T05:04:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:54:47.501822Z"}],"nvd":[{"id":"CVE-2022-20770","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:15:08.377Z","modified":"2026-06-17T04:25:03.463Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"ALPINE-CVE-2022-20770","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:15:08.377Z","modified":"2026-11-03T07:18:33.071652822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-9666","title":"CVE-2022-20770 affecting package clamav for versions less than 0.105.0-1","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:15:08Z","modified":"2026-04-21T04:35:06.173789Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"CVE-2022-20770","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:15:08.377Z","modified":"2026-10-24T10:31:00.534107678Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-20770","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:15:08.377Z","modified":"2026-11-03T08:02:09.737211869Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2022-1683","title":"clamav security update","description":"Clam AntiVirus (clamav) is an open source antivirus engine for detecting trojans, viruses, malware and other malicious threats. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. he virus database is based on the virus database from OpenAntiVirus, but contains additional signatures and is KEPT UP TO DATE.\n\nSecurity Fix(es):\n\nOn April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.(CVE-2022-20770)\n\nOn April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in the TIFF file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.(CVE-2022-20771)\n\nOn April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.(CVE-2022-20785)\n\nFixed a possible multi-byte heap buffer overflow write vulnerability in the signature database load module. The fix was to update the vendored regex library to the latest version. Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. Thank you to Michał Dardas for reporting this issue.(CVE-2022-20792)","status":"published","published":"2022-05-28T11:04:57Z","modified":"2026-08-18T01:16:39.487223369Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-20770","description":"On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.","status":"published","published":"2022-05-04T17:15:00Z","modified":"2026-04-22T13:14:12.963441Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DLA-3042-1","title":"clamav - security update","status":"published","published":"2022-06-03T00:00:00Z","modified":"2026-03-09T01:22:58.665467Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0187","title":"Updated clamav packages fix security vulnerability","description":"Infinite loop vulnerability in the CHM file parser. Issue affects versions\n0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions.\n(CVE-2022-20770)\n\nInfinite loop vulnerability in the TIFF file parser. Issue affects versions\n0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. The\nissue only occurs if the \"--alert-broken-media\" ClamScan option is enabled.\nFor ClamD, the affected option is \"AlertBrokenMedia yes\", and for libclamav\nit is the \"CL_SCAN_HEURISTIC_BROKEN_MEDIA\" scan option. (CVE-2022-20771)\n\nMemory leak in the HTML file parser / Javascript normalizer. Issue affects\nversions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior\nversions. (CVE-2022-20785)\n\nMulti-byte heap buffer overflow write vulnerability in the signature\ndatabase load module. The fix was to update the vendored regex library to\nthe latest version. Issue affects versions 0.104.0 through 0.104.2 and LTS\nversion 0.103.5 and prior versions. (CVE-2022-20792)\n\nNULL-pointer dereference crash in the scan verdict cache check. Issue\naffects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2. (CVE-2022-20796)\n","status":"published","published":"2022-05-15T10:06:40Z","modified":"2026-04-16T04:41:14.842972382Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12047-1","title":"clamav-0.103.6-1.1 on GA media","description":"These are all security issues fixed in the clamav-0.103.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:47.008776Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1644-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\n- CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM file parser (bsc#1199242).\n- CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the scan verdict cache check (bsc#1199246).\n- CVE-2022-20771: Fixed a possible infinite loop vulnerability in the TIFF file parser (bsc#1199244).\n- CVE-2022-20785: Fixed a possible memory leak in the HTML file parser / Javascript normalizer (bsc#1199245).\n- CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write vulnerability in the signature database load module (bsc#1199274).\n","status":"published","published":"2022-05-12T05:57:38Z","modified":"2026-02-04T03:37:22.845641Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1647-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\n- CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM file parser (bsc#1199242).\n- CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the scan verdict cache check (bsc#1199246).\n- CVE-2022-20771: Fixed a possible infinite loop vulnerability in the TIFF file parser (bsc#1199244).\n- CVE-2022-20785: Fixed a possible memory leak in the HTML file parser / Javascript normalizer (bsc#1199245).\n- CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write vulnerability in the signature database load module (bsc#1199274).\n","status":"published","published":"2022-05-12T15:13:29Z","modified":"2026-02-04T03:15:09.048238Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5423-1","title":"clamav vulnerabilities","description":"Michał Dardas discovered that ClamAV incorrectly handled parsing CHM files.\nA remote attacker could possibly use this issue to cause ClamAV to stop\nresponding, resulting in a denial of service.  (CVE-2022-20770)\n\nMichał Dardas discovered that ClamAV incorrectly handled parsing TIFF\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\nstop responding, resulting in a denial of service. (CVE-2022-20771)\n\nMichał Dardas discovered that ClamAV incorrectly handled parsing HTML\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\nconsume resources, resulting in a denial of service. (CVE-2022-20785)\n\nMichał Dardas discovered that ClamAV incorrectly handled loading the\nsignature database. A remote attacker could possibly use this issue to\ncause ClamAV to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2022-20792)\n\nAlexander Patrakov and Antoine Gatineau discovered that ClamAV incorrectly\nhandled the scan verdict cache check. A remote attacker could possibly use\nthis issue to cause ClamAV to crash, resulting in a denial of service, or\npossibly execute arbitrary code.(CVE-2022-20796)\n","status":"published","published":"2022-05-17T11:35:36Z","modified":"2026-04-22T10:23:35.713081Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5423-2","title":"clamav vulnerabilities","description":"USN-5423-1 fixed several vulnerabilities in ClamAV. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and 16.04 ESM.\n\n\nOriginal advisory details:\n\n Michał Dardas discovered that ClamAV incorrectly handled parsing CHM files.\n A remote attacker could possibly use this issue to cause ClamAV to stop\n responding, resulting in a denial of service.  (CVE-2022-20770)\n\n Michał Dardas discovered that ClamAV incorrectly handled parsing TIFF\n files. A remote attacker could possibly use this issue to cause ClamAV to\n stop responding, resulting in a denial of service. (CVE-2022-20771)\n\n Michał Dardas discovered that ClamAV incorrectly handled parsing HTML\n files. A remote attacker could possibly use this issue to cause ClamAV to\n consume resources, resulting in a denial of service. (CVE-2022-20785)\n\n Michał Dardas discovered that ClamAV incorrectly handled loading the\n signature database. A remote attacker could possibly use this issue to\n cause ClamAV to crash, resulting in a denial of service, or possibly\n execute arbitrary code. (CVE-2022-20792)\n\n Alexander Patrakov and Antoine Gatineau discovered that ClamAV incorrectly\n handled the scan verdict cache check. A remote attacker could possibly use\n this issue to cause ClamAV to crash, resulting in a denial of service, or\n possibly execute arbitrary code.(CVE-2022-20796)\n","status":"published","published":"2022-05-17T15:36:09Z","modified":"2026-06-29T13:49:37.961407779Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}