{"id":"CVE-2022-20796","aliases":["ALPINE-CVE-2022-20796","AZL-9668","DEBIAN-CVE-2022-20796","DLA-3042-1","EUVD-2022-26046","GHSA-mp8h-qmxp-c39w","MGASA-2022-0187","SUSE-SU-2022:1644-1","SUSE-SU-2022:1647-1","UBUNTU-CVE-2022-20796","USN-5423-1","USN-5423-2","openSUSE-SU-2024:12047-1"],"status":"published","title":"ClamAV Truncated File Denial of Service Vulnerability Affecting Cisco Products: April 2022","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00388,"percentile":0.3322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-476","CWE-822"],"published":"2022-05-04T17:06:09Z","modified":"2026-11-03T08:00:55Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"clamav","fixed_in":["0.103.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"clamav","fixed_in":["0.103.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"clamav","fixed_in":["0.105.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"clamav","fixed_in":["0.103.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"clamav","fixed_in":["0.103.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"clamav","fixed_in":["0.103.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.14.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"clamav","fixed_in":["0.103.6+dfsg-0ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0+deb9u1"}]}],"versions":["0.100.0+dfsg-0+deb9u1","0.100.0+dfsg-0+deb9u2","0.100.0+dfsg-1","0.100.0~beta+dfsg-1","0.100.0~beta+dfsg-2","0.100.1+dfsg-0+deb9u1","0.100.1+dfsg-1","0.100.2+dfsg-0+deb9u1","0.100.2+dfsg-1","0.100.2+dfsg-2","0.100.3+dfsg-0+deb9u1","0.101.0+dfsg-1","0.101.1+dfsg-1","0.101.1+dfsg-2","0.101.1+dfsg-3","0.101.2+dfsg-0+deb9u1","0.101.2+dfsg-1","0.101.2+dfsg-2","0.101.2+dfsg-3","0.101.4+dfsg-0+deb9u1","0.101.4+dfsg-1","0.102.1+dfsg-0+deb9u1","0.102.1+dfsg-0+deb9u2","0.102.1+dfsg-1","0.102.1+dfsg-2","0.102.1+dfsg-3","0.102.2+dfsg-0~deb9u1","0.102.2+dfsg-1","0.102.2+dfsg-2","0.102.3+dfsg-0~deb9u1","0.102.3+dfsg-1","0.102.4+dfsg-0+deb9u1","0.102.4+dfsg-0+deb9u2","0.102.4+dfsg-1","0.103.0+dfsg-1","0.103.0+dfsg-2","0.103.0+dfsg-3","0.103.0+dfsg-3.1","0.103.2+dfsg-1","0.103.2+dfsg-2","0.103.3+dfsg-1","0.103.4+dfsg-0+deb9u1","0.103.4+dfsg-1","0.103.5+dfsg-1","0.99.2+dfsg-6","0.99.2+dfsg-6+deb9u1","0.99.3~beta1+dfsg-1","0.99.3~beta1+dfsg-2","0.99.3~beta1+dfsg-3","0.99.3~beta1+dfsg-4","0.99.3~beta2+dfsg-1","0.99.3~snapshot20170704+dfsg-1","0.99.4+dfsg-1+deb9u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:8","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-1.mga8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-150000.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.14.04.1+esm1"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3","0.100.1+dfsg-1ubuntu0.14.04.4","0.100.2+dfsg-1ubuntu0.14.04.1","0.100.2+dfsg-1ubuntu0.14.04.2","0.100.3+dfsg-0ubuntu0.14.04.1","0.100.3+dfsg-0ubuntu0.14.04.1+esm1","0.101.4+dfsg-0ubuntu0.14.04.1+esm1","0.102.1+dfsg-0ubuntu0.14.04.1+esm1","0.102.2+dfsg-0ubuntu0.14.04.1+esm1","0.102.3+dfsg-0ubuntu0.14.04.1+esm1","0.102.4+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm2","0.103.5+dfsg-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.16.04.1+esm1"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2","0.100.1+dfsg-1ubuntu0.16.04.3","0.100.2+dfsg-1ubuntu0.16.04.1","0.100.3+dfsg-0ubuntu0.16.04.1","0.101.4+dfsg-0ubuntu0.16.04.1","0.102.1+dfsg-0ubuntu0.16.04.2","0.102.2+dfsg-0ubuntu0.16.04.1","0.102.3+dfsg-0ubuntu0.16.04.1","0.102.4+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1+esm1","0.103.5+dfsg-0ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.18.04.1"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2","0.100.1+dfsg-1ubuntu0.18.04.3","0.100.2+dfsg-1ubuntu0.18.04.1","0.100.3+dfsg-0ubuntu0.18.04.1","0.101.4+dfsg-0ubuntu0.18.04.1","0.102.1+dfsg-0ubuntu0.18.04.2","0.102.2+dfsg-0ubuntu0.18.04.1","0.102.3+dfsg-0ubuntu0.18.04.1","0.102.4+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.2","0.103.2+dfsg-0ubuntu0.18.04.3","0.103.5+dfsg-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.20.04.1"}]}],"versions":["0.101.4+dfsg-1ubuntu1","0.102.1+dfsg-1ubuntu1","0.102.1+dfsg-2ubuntu1","0.102.1+dfsg-2ubuntu2","0.102.2+dfsg-1ubuntu1","0.102.2+dfsg-2ubuntu1","0.102.3+dfsg-0ubuntu0.20.04.1","0.102.4+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.2","0.103.5+dfsg-1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.22.04.1"}]}],"versions":["0.103.3+dfsg-1","0.103.4+dfsg-1","0.103.4+dfsg-1build1","0.103.5+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.18.04.1"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2","0.100.1+dfsg-1ubuntu0.18.04.3","0.100.2+dfsg-1ubuntu0.18.04.1","0.100.3+dfsg-0ubuntu0.18.04.1","0.101.4+dfsg-0ubuntu0.18.04.1","0.102.1+dfsg-0ubuntu0.18.04.2","0.102.2+dfsg-0ubuntu0.18.04.1","0.102.3+dfsg-0ubuntu0.18.04.1","0.102.4+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.2","0.103.2+dfsg-0ubuntu0.18.04.3","0.103.5+dfsg-0ubuntu0.18.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.20.04.1"}]}],"versions":["0.101.4+dfsg-1ubuntu1","0.102.1+dfsg-1ubuntu1","0.102.1+dfsg-2ubuntu1","0.102.1+dfsg-2ubuntu2","0.102.2+dfsg-1ubuntu1","0.102.2+dfsg-2ubuntu1","0.102.3+dfsg-0ubuntu0.20.04.1","0.102.4+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.2","0.103.5+dfsg-1~20.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.22.04.1"}]}],"versions":["0.103.3+dfsg-1","0.103.4+dfsg-1","0.103.4+dfsg-1build1","0.103.5+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.14.04.1+esm1"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3","0.100.1+dfsg-1ubuntu0.14.04.4","0.100.2+dfsg-1ubuntu0.14.04.1","0.100.2+dfsg-1ubuntu0.14.04.2","0.100.3+dfsg-0ubuntu0.14.04.1","0.100.3+dfsg-0ubuntu0.14.04.1+esm1","0.101.4+dfsg-0ubuntu0.14.04.1+esm1","0.102.1+dfsg-0ubuntu0.14.04.1+esm1","0.102.2+dfsg-0ubuntu0.14.04.1+esm1","0.102.3+dfsg-0ubuntu0.14.04.1+esm1","0.102.4+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm2","0.103.5+dfsg-0ubuntu0.14.04.1+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6+dfsg-0ubuntu0.16.04.1+esm1"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2","0.100.1+dfsg-1ubuntu0.16.04.3","0.100.2+dfsg-1ubuntu0.16.04.1","0.100.3+dfsg-0ubuntu0.16.04.1","0.101.4+dfsg-0ubuntu0.16.04.1","0.102.1+dfsg-0ubuntu0.16.04.2","0.102.2+dfsg-0ubuntu0.16.04.1","0.102.3+dfsg-0ubuntu0.16.04.1","0.102.4+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1+esm1","0.103.5+dfsg-0ubuntu0.16.04.1+esm1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.6-1.1"}]}],"bundled":5}],"products":[{"vendor":"cisco","product":"cisco amp for endpoints"},{"vendor":"cisco","product":"secure_endpoint"},{"vendor":"clamav","product":"clamav"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-vL9x58p4","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RV6BLIATIJE74SQ6NG5ZC4JK5MMDQ2R/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4NNBIJVG6Z4PDIKUZXTYXICYUAYAZ56/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BX5ZXNHP4NFYQ5BFSKY3WT7NTBZUYG7L/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00004.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202310-01","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20796","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RV6BLIATIJE74SQ6NG5ZC4JK5MMDQ2R/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BX5ZXNHP4NFYQ5BFSKY3WT7NTBZUYG7L/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N4NNBIJVG6Z4PDIKUZXTYXICYUAYAZ56/"},{"url":"https://github.com/advisories/GHSA-mp8h-qmxp-c39w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-20796","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-20796","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0187.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30417","tags":["report"]},{"url":"https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html","tags":["web","report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221647-1/","tags":["web","advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OQIRF7L5ZKGSRUC6DDORCDJYKMVJMCEB/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221644-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199242","tags":["report"]},{"url":"https://bugzilla.suse.com/1199244","tags":["report"]},{"url":"https://bugzilla.suse.com/1199245","tags":["report"]},{"url":"https://bugzilla.suse.com/1199246","tags":["report"]},{"url":"https://bugzilla.suse.com/1199274","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-20796","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-20796","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5423-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5423-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-20792","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-20796","title":"ClamAV Truncated File Denial of Service Vulnerability Affecting Cisco Products: April 2022","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:06:09.04Z","modified":"2024-11-06T16:15:40.237Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-822"],"updated_at":"2026-11-02T14:34:24.627322Z"}],"euvd":[{"id":"EUVD-2022-26046","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:06:09Z","modified":"2024-11-06T16:15:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:10.085157Z"}],"ghsa":[{"id":"GHSA-mp8h-qmxp-c39w","title":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and...","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-05T00:00:17Z","modified":"2023-10-10T05:04:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119","CWE-476","CWE-822"],"updated_at":"2026-11-02T14:54:47.501822Z"}],"nvd":[{"id":"CVE-2022-20796","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:15:08.797Z","modified":"2026-06-17T04:25:07.887Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-822","CWE-476"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"ALPINE-CVE-2022-20796","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:15:08.797Z","modified":"2026-11-03T07:18:33.072744514Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-9668","title":"CVE-2022-20796 affecting package clamav for versions less than 0.105.0-1","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:15:08Z","modified":"2026-04-21T04:35:06.489447Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"CVE-2022-20796","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:15:08.797Z","modified":"2026-10-24T10:30:24.409695697Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-20796","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:15:08.797Z","modified":"2026-11-03T08:00:55.377346534Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-20796","description":"On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.","status":"published","published":"2022-05-04T17:15:00Z","modified":"2026-04-22T13:14:59.208896Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DLA-3042-1","title":"clamav - security update","status":"published","published":"2022-06-03T00:00:00Z","modified":"2026-03-09T01:22:58.665467Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0187","title":"Updated clamav packages fix security vulnerability","description":"Infinite loop vulnerability in the CHM file parser. Issue affects versions\n0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions.\n(CVE-2022-20770)\n\nInfinite loop vulnerability in the TIFF file parser. Issue affects versions\n0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. The\nissue only occurs if the \"--alert-broken-media\" ClamScan option is enabled.\nFor ClamD, the affected option is \"AlertBrokenMedia yes\", and for libclamav\nit is the \"CL_SCAN_HEURISTIC_BROKEN_MEDIA\" scan option. (CVE-2022-20771)\n\nMemory leak in the HTML file parser / Javascript normalizer. Issue affects\nversions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior\nversions. (CVE-2022-20785)\n\nMulti-byte heap buffer overflow write vulnerability in the signature\ndatabase load module. The fix was to update the vendored regex library to\nthe latest version. Issue affects versions 0.104.0 through 0.104.2 and LTS\nversion 0.103.5 and prior versions. (CVE-2022-20792)\n\nNULL-pointer dereference crash in the scan verdict cache check. Issue\naffects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2. (CVE-2022-20796)\n","status":"published","published":"2022-05-15T10:06:40Z","modified":"2026-04-16T04:41:14.842972382Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12047-1","title":"clamav-0.103.6-1.1 on GA media","description":"These are all security issues fixed in the clamav-0.103.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:47.008776Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1644-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\n- CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM file parser (bsc#1199242).\n- CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the scan verdict cache check (bsc#1199246).\n- CVE-2022-20771: Fixed a possible infinite loop vulnerability in the TIFF file parser (bsc#1199244).\n- CVE-2022-20785: Fixed a possible memory leak in the HTML file parser / Javascript normalizer (bsc#1199245).\n- CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write vulnerability in the signature database load module (bsc#1199274).\n","status":"published","published":"2022-05-12T05:57:38Z","modified":"2026-02-04T03:37:22.845641Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1647-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\n- CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM file parser (bsc#1199242).\n- CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the scan verdict cache check (bsc#1199246).\n- CVE-2022-20771: Fixed a possible infinite loop vulnerability in the TIFF file parser (bsc#1199244).\n- CVE-2022-20785: Fixed a possible memory leak in the HTML file parser / Javascript normalizer (bsc#1199245).\n- CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write vulnerability in the signature database load module (bsc#1199274).\n","status":"published","published":"2022-05-12T15:13:29Z","modified":"2026-02-04T03:15:09.048238Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5423-1","title":"clamav vulnerabilities","description":"Michał Dardas discovered that ClamAV incorrectly handled parsing CHM files.\nA remote attacker could possibly use this issue to cause ClamAV to stop\nresponding, resulting in a denial of service.  (CVE-2022-20770)\n\nMichał Dardas discovered that ClamAV incorrectly handled parsing TIFF\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\nstop responding, resulting in a denial of service. (CVE-2022-20771)\n\nMichał Dardas discovered that ClamAV incorrectly handled parsing HTML\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\nconsume resources, resulting in a denial of service. (CVE-2022-20785)\n\nMichał Dardas discovered that ClamAV incorrectly handled loading the\nsignature database. A remote attacker could possibly use this issue to\ncause ClamAV to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2022-20792)\n\nAlexander Patrakov and Antoine Gatineau discovered that ClamAV incorrectly\nhandled the scan verdict cache check. A remote attacker could possibly use\nthis issue to cause ClamAV to crash, resulting in a denial of service, or\npossibly execute arbitrary code.(CVE-2022-20796)\n","status":"published","published":"2022-05-17T11:35:36Z","modified":"2026-04-22T10:23:35.713081Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5423-2","title":"clamav vulnerabilities","description":"USN-5423-1 fixed several vulnerabilities in ClamAV. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and 16.04 ESM.\n\n\nOriginal advisory details:\n\n Michał Dardas discovered that ClamAV incorrectly handled parsing CHM files.\n A remote attacker could possibly use this issue to cause ClamAV to stop\n responding, resulting in a denial of service.  (CVE-2022-20770)\n\n Michał Dardas discovered that ClamAV incorrectly handled parsing TIFF\n files. A remote attacker could possibly use this issue to cause ClamAV to\n stop responding, resulting in a denial of service. (CVE-2022-20771)\n\n Michał Dardas discovered that ClamAV incorrectly handled parsing HTML\n files. A remote attacker could possibly use this issue to cause ClamAV to\n consume resources, resulting in a denial of service. (CVE-2022-20785)\n\n Michał Dardas discovered that ClamAV incorrectly handled loading the\n signature database. A remote attacker could possibly use this issue to\n cause ClamAV to crash, resulting in a denial of service, or possibly\n execute arbitrary code. (CVE-2022-20792)\n\n Alexander Patrakov and Antoine Gatineau discovered that ClamAV incorrectly\n handled the scan verdict cache check. A remote attacker could possibly use\n this issue to cause ClamAV to crash, resulting in a denial of service, or\n possibly execute arbitrary code.(CVE-2022-20796)\n","status":"published","published":"2022-05-17T15:36:09Z","modified":"2026-06-29T13:49:37.961407779Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}