{"id":"CVE-2024-20328","aliases":["ALPINE-CVE-2024-20328","AZL-35428","AZL-35431","CLSA-2025-1756923561","DEBIAN-CVE-2024-20328","EUVD-2024-18043","GHSA-vhq6-cjc8-x8v9","MGASA-2024-0048","UBUNTU-CVE-2024-20328"],"status":"published","title":"ClamAV VirusEvent File Processing Command Injection Vulnerability","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.84841,"percentile":0.99712,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2024-02-09T00:00:00Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"clamav","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"clamav","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"clamav","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"clamav","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"clamav","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"clamav","fixed_in":["1.2.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"clamav","fixed_in":["0.105.2-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"clamav","fixed_in":["1.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"clamav","fixed_in":["1.0.5+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"clamav","fixed_in":["1.0.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"clamav","fixed_in":["1.0.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"clamav","fixed_in":["1.0.5+dfsg-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.2.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105.2-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5+dfsg-1~deb12u1"}]}],"versions":["1.0.1+dfsg-2","1.0.2+dfsg-1","1.0.2+dfsg-1~deb12u1","1.0.3+dfsg-1","1.0.3+dfsg-1~deb12u1","1.0.3+dfsg-2","1.0.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5+dfsg-1ubuntu1"}]}],"versions":["1.0.2+dfsg-1ubuntu1","1.0.3+dfsg-2ubuntu1","1.0.4+dfsg-0ubuntu1"]}],"products":[{"vendor":"cisco","product":"clamav"},{"vendor":"clamav","product":"clamav"}],"references":[{"url":"https://blog.clamav.net/2023/11/clamav-130-122-105-released.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20328","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ"},{"url":"https://github.com/advisories/GHSA-vhq6-cjc8-x8v9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-20328","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2025-1756923561.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-20328","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0048.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-20328","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6636-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-20328","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-20328","title":"ClamAV VirusEvent File Processing Command Injection Vulnerability","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n","status":"published","published":"2024-03-01T20:48:15.328Z","modified":"2025-11-04T18:22:37.791Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:33:56.402064Z"}],"euvd":[{"id":"EUVD-2024-18043","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n","status":"published","published":"2024-03-01T20:48:15Z","modified":"2025-11-04T18:22:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:23.723839Z"}],"ghsa":[{"id":"GHSA-vhq6-cjc8-x8v9","title":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject...","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2024-03-01T21:31:17Z","modified":"2026-03-20T05:07:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:06:44.064136Z"}],"nvd":[{"id":"CVE-2024-20328","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n","status":"published","published":"2024-03-01T21:15:07.79Z","modified":"2026-06-17T07:06:26.7Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"ALPINE-CVE-2024-20328","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n","status":"published","published":"2024-03-01T21:15:07.79Z","modified":"2026-11-03T06:32:59.545705099Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2024-20328","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n","status":"published","published":"2024-03-01T21:15:07.79Z","modified":"2026-10-24T10:30:17.29508176Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-20328","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2024-03-01T21:15:07.79Z","modified":"2026-11-02T12:00:29.665314205Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-20328","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2024-02-09T00:00:00Z","modified":"2026-04-22T14:37:29.300782Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"AZL-35428","title":"CVE-2024-20328 affecting package clamav for versions less than 0.105.2-5","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n","status":"published","published":"2024-03-01T21:15:07Z","modified":"2026-04-21T04:28:04.446639Z","updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35431","title":"CVE-2024-20328 affecting package clamav for versions less than 1.0.6-1","description":"A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands.\nClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\n\n","status":"published","published":"2024-03-01T21:15:07Z","modified":"2026-04-21T04:51:52.796175Z","updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"CLSA-2025-1756923561","title":"clamav: Fix of 8 CVEs","description":"- Update to 1.0.9 LTS version\n- CVE-2025-20260: Fixed a possible buffer overflow write bug in\n  the PDF file parser\n- CVE-2025-20128: Fixed a possible buffer overflow read bug in\n  the OLE2 file parser\n- CVE-2024-20506: Changed the logging module to disable following\n  symlinks on Linux and Unix systems so as to prevent an attacker\n  with existing access to the 'clamd' or 'freshclam' services from\n  using a symlink to corrupt system files\n- CVE-2024-20290: Fixed a possible heap overflow read bug in\n  the OLE2 file parser\n- CVE-2024-20328: Fixed a possible command injection in the\n  'VirusEvent' feature of the clamd service\n- CVE-2023-20197: Fixed a possible denial of service in the\n  HFS+ parser\n- CVE-2023-20212: Fixed a possible DoS in the AutoIT file\n  parser\n- CVE-2023-20052: Fixed a possible remote information leak\n  in the DMG file parser","status":"published","published":"2025-09-03T18:19:25Z","modified":"2026-10-21T10:47:48.42966016Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"MGASA-2024-0048","title":"Updated clamav packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nA possible heap overflow read bug in the OLE2 file parser that could\ncause a denial-of-service (DoS) condition. (CVE-2024-20290)\nA possible command injection vulnerability in the \"VirusEvent\" feature\nof ClamAV's ClamD service. (CVE-2024-20328)\n","status":"published","published":"2024-02-24T22:51:43Z","modified":"2026-04-16T04:42:59.301529482Z","updated_at":"2026-11-02T15:49:42.684501Z"}]}}