{"id":"CVE-2023-20212","aliases":["CLSA-2025-1756202550","CLSA-2025-1756923561","DEBIAN-CVE-2023-20212","EUVD-2023-24391","GHSA-25vx-3h3c-mwv8","MGASA-2023-0257","UBUNTU-CVE-2023-20212"],"status":"published","title":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to...","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r\n\r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03441,"percentile":0.89133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-825"],"published":"2023-08-18T19:55:33Z","modified":"2026-10-26T18:00:26Z","fixes":[{"ecosystem":"Debian:12","package":"clamav","fixed_in":["1.0.2+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"clamav","fixed_in":["1.0.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"clamav","fixed_in":["1.0.2+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-testfiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamdscan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libclamav-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libclamav12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2+dfsg-1~deb12u1"}]}],"versions":["1.0.1+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.103.10-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1.mga9"}]}],"bundled":2}],"products":[{"vendor":"cisco","product":"cisco secure endpoint"},{"vendor":"cisco","product":"secure_endpoint"},{"vendor":"cisco","product":"secure_endpoint_private_cloud"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-FTkhqMWZ","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20212"},{"url":"https://github.com/advisories/GHSA-25vx-3h3c-mwv8"},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2025-1756202550.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2025-1756923561.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-20212","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0257.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-20212","tags":["report"]},{"url":"https://blog.clamav.net/2023/07/2023-08-16-releases.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20212","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-20212","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r\n\r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","status":"published","published":"2023-08-18T19:55:33.359Z","modified":"2024-08-02T09:05:35.369Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T14:35:13.368958Z"}],"euvd":[{"id":"EUVD-2023-24391","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r\n\r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","status":"published","published":"2023-08-18T19:55:33Z","modified":"2024-08-02T09:05:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:08.95234Z"}],"ghsa":[{"id":"GHSA-25vx-3h3c-mwv8","title":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to...","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \n\n This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","status":"published","published":"2023-08-18T21:30:24Z","modified":"2024-02-03T05:06:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T14:55:32.369456Z"}],"nvd":[{"id":"CVE-2023-20212","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r\n\r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","status":"published","published":"2023-08-18T20:15:09.773Z","modified":"2026-06-17T05:29:54.623Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T14:08:24.487686Z"}],"osv":[{"id":"CVE-2023-20212","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r\n\r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","status":"published","published":"2023-08-18T20:15:09.773Z","modified":"2026-04-16T04:43:34.971253576Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-20212","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r \r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","status":"published","published":"2023-08-18T20:15:09.773Z","modified":"2026-10-26T18:00:26.793052569Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-20212","description":"A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.","status":"withdrawn","published":"2023-08-18T20:15:00Z","modified":"2025-07-16T07:45:35.957499Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"CLSA-2025-1756202550","title":"Fix of 9 CVEs","description":"   * Update up to 1.4.3 LTS\n     - CVE-2025-20260\n     - CVE-2025-20234\n     - CVE-2025-20128\n     - CVE-2024-20505, CVE-2024-20506\n     - CVE-2023-20197\n     - CVE-2023-20212\n     - CVE-2023-20032\n     - CVE-2023-20052","status":"published","published":"2025-08-26T10:02:35Z","modified":"2026-06-04T10:04:10.772300369Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1756923561","title":"clamav: Fix of 8 CVEs","description":"- Update to 1.0.9 LTS version\n- CVE-2025-20260: Fixed a possible buffer overflow write bug in\n  the PDF file parser\n- CVE-2025-20128: Fixed a possible buffer overflow read bug in\n  the OLE2 file parser\n- CVE-2024-20506: Changed the logging module to disable following\n  symlinks on Linux and Unix systems so as to prevent an attacker\n  with existing access to the 'clamd' or 'freshclam' services from\n  using a symlink to corrupt system files\n- CVE-2024-20290: Fixed a possible heap overflow read bug in\n  the OLE2 file parser\n- CVE-2024-20328: Fixed a possible command injection in the\n  'VirusEvent' feature of the clamd service\n- CVE-2023-20197: Fixed a possible denial of service in the\n  HFS+ parser\n- CVE-2023-20212: Fixed a possible DoS in the AutoIT file\n  parser\n- CVE-2023-20052: Fixed a possible remote information leak\n  in the DMG file parser","status":"published","published":"2025-09-03T18:19:25Z","modified":"2026-10-21T10:47:48.42966016Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"MGASA-2023-0257","title":"Updated clamav packages fix security vulnerability","description":"A vulnerability in the filesystem image parser for Hierarchical File\nSystem Plus (HFS+) of ClamAV could allow an unauthenticated, remote\nattacker to cause a denial of service (DoS) condition on an affected\ndevice. This vulnerability is due to an incorrect check for completion\nwhen a file is decompressed, which may result in a loop condition that\ncould cause the affected software to stop responding. An attacker could\nexploit this vulnerability by submitting a crafted HFS+ filesystem image\nto be scanned by ClamAV on an affected device. A successful exploit could\nallow the attacker to cause the ClamAV scanning process to stop\nresponding, resulting in a DoS condition on the affected software and\nconsuming available system resources. (CVE-2023-20197)\n\nA vulnerability in the AutoIt module of ClamAV could allow an\nunauthenticated, remote attacker to cause a denial of service (DoS)\ncondition on an affected device. This vulnerability is due to a logic\nerror in the memory management of an affected device. An attacker could\nexploit this vulnerability by submitting a crafted AutoIt file to be\nscanned by ClamAV on the affected device. A successful exploit could\nallow the attacker to cause the ClamAV scanning process to restart\nunexpectedly, resulting in a DoS condition. (CVE-2023-20212)\n","status":"published","published":"2023-09-11T13:07:54Z","modified":"2026-04-16T04:40:56.281618118Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}