{"id":"CVE-2025-20128","aliases":["ALPINE-CVE-2025-20128","CLSA-2025-1756202550","CLSA-2025-1756409595","CLSA-2025-1756923561","DEBIAN-CVE-2025-20128","DLA-4292-1","EUVD-2025-2155","GHSA-6j5q-p9xp-3cc6","MGASA-2025-0031","SUSE-SU-2025:0325-1","SUSE-SU-2025:0327-1","SUSE-SU-2025:0328-1","UBUNTU-CVE-2025-20128","USN-7229-1","openSUSE-SU-2025:14683-1"],"status":"published","title":"ClamAV OLE2 File Format Decryption Denial of Service Vulnerability","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r\nFor a description of this vulnerability, see the .\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01815,"percentile":0.78837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-122"],"published":"2025-01-22T16:21:12Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"clamav","fixed_in":["1.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"clamav","fixed_in":["1.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"clamav","fixed_in":["1.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"clamav","fixed_in":["1.4.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"clamav","fixed_in":["1.0.9+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"clamav","fixed_in":["1.4.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"clamav","fixed_in":["1.4.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"clamav","fixed_in":["1.0.8-1.mga9"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"clamav","fixed_in":["1.0.8+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.4.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-testfiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamdscan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libclamav-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libclamav12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1.el6.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9+dfsg-1~deb12u1"}]}],"versions":["1.0.1+dfsg-2","1.0.2+dfsg-1","1.0.2+dfsg-1~deb12u1","1.0.3+dfsg-1","1.0.3+dfsg-1~deb12u1","1.0.3+dfsg-2","1.0.4+dfsg-1","1.0.5+dfsg-1","1.0.5+dfsg-1.1","1.0.5+dfsg-1~deb12u1","1.0.6+dfsg-1","1.0.7+dfsg-1~deb11u1","1.0.7+dfsg-1~deb11u2","1.0.7+dfsg-1~deb12u1","1.0.9+dfsg-1~deb11u1"]},{"source":"osv","ecosystem":"Debian:13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9+dfsg-1~deb11u1"}]}],"versions":["0.103.10+dfsg-0+deb11u1","0.103.2+dfsg-2","0.103.3+dfsg-0+deb11u1","0.103.3+dfsg-1","0.103.4+dfsg-0+deb11u1","0.103.4+dfsg-1","0.103.5+dfsg-0+deb11u1","0.103.5+dfsg-1","0.103.6+dfsg-0+deb11u1","0.103.6+dfsg-1","0.103.7+dfsg-0+deb11u1","0.103.7+dfsg-1","0.103.8+dfsg-0+deb11u1","0.103.9+dfsg-0+deb11u1","1.0.0+dfsg-1","1.0.0+dfsg-2","1.0.0+dfsg-3","1.0.0+dfsg-4","1.0.0+dfsg-5","1.0.0+dfsg-6","1.0.1+dfsg-1","1.0.1+dfsg-2","1.0.2+dfsg-1","1.0.2+dfsg-1~deb12u1","1.0.3+dfsg-1","1.0.3+dfsg-1~deb12u1","1.0.3+dfsg-2","1.0.4+dfsg-1","1.0.5+dfsg-1","1.0.5+dfsg-1.1","1.0.5+dfsg-1~deb12u1","1.0.6+dfsg-1","1.0.7+dfsg-1~deb11u1","1.0.7+dfsg-1~deb11u2","1.0.7+dfsg-1~deb12u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150200.8.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150600.18.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-150600.18.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8+dfsg-0ubuntu0.24.04.1"}]}],"versions":["1.0.2+dfsg-1ubuntu1","1.0.3+dfsg-2ubuntu1","1.0.4+dfsg-0ubuntu1","1.0.5+dfsg-1ubuntu1","1.0.5+dfsg-1.1ubuntu2","1.0.5+dfsg-1.1ubuntu3","1.0.7+dfsg-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8+dfsg-0ubuntu0.24.04.1"}]}],"versions":["1.0.2+dfsg-1ubuntu1","1.0.3+dfsg-2ubuntu1","1.0.4+dfsg-0ubuntu1","1.0.5+dfsg-1ubuntu1","1.0.5+dfsg-1.1ubuntu2","1.0.5+dfsg-1.1ubuntu3","1.0.7+dfsg-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1.1"}]}],"bundled":3}],"products":[{"vendor":"cisco","product":"cisco secure endpoint"},{"vendor":"cisco","product":"secure_endpoint"},{"vendor":"cisco","product":"secure_endpoint_private_cloud"},{"vendor":"clamav","product":"clamav"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA","tags":["Third Party Advisory","advisory","report"]},{"url":"https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html","tags":["Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00006.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20128"},{"url":"https://github.com/advisories/GHSA-6j5q-p9xp-3cc6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-20128","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2025-1756202550.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1756409595.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2025-1756923561.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-20128","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33969","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7229-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250325-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1102840","tags":["report"]},{"url":"https://bugzilla.suse.com/1103032","tags":["report"]},{"url":"https://bugzilla.suse.com/1180296","tags":["report"]},{"url":"https://bugzilla.suse.com/1202986","tags":["report"]},{"url":"https://bugzilla.suse.com/1211594","tags":["report"]},{"url":"https://bugzilla.suse.com/1214342","tags":["report"]},{"url":"https://bugzilla.suse.com/1232242","tags":["report"]},{"url":"https://bugzilla.suse.com/1236307","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-20197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20128","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250327-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250328-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-20128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-20128","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9050","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-20128","title":"ClamAV OLE2 File Format Decryption Denial of Service Vulnerability","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r\nFor a description of this vulnerability, see the .\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-22T16:21:12.329Z","modified":"2025-11-03T18:08:43.23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:25.5658Z"}],"euvd":[{"id":"EUVD-2025-2155","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r\nFor a description of this vulnerability, see the .\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-22T16:21:12Z","modified":"2025-11-03T18:08:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:34.635725Z"}],"ghsa":[{"id":"GHSA-6j5q-p9xp-3cc6","title":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could...","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\n\nThis vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\nFor a description of this vulnerability, see the .\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-22T18:31:55Z","modified":"2025-11-03T21:32:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-120","CWE-122"],"updated_at":"2026-11-02T15:04:20.412437Z"}],"nvd":[{"id":"CVE-2025-20128","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r\nFor a description of this vulnerability, see the .\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-22T17:15:12.583Z","modified":"2026-06-17T08:40:44.027Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:10:49.483601Z"}],"osv":[{"id":"ALPINE-CVE-2025-20128","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r\nFor a description of this vulnerability, see the .\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-22T17:15:12.583Z","modified":"2026-11-03T06:33:00.338881118Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2025-20128","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r\nFor a description of this vulnerability, see the .\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-22T17:15:12.583Z","modified":"2026-10-24T10:30:53.240341249Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"DEBIAN-CVE-2025-20128","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r \r This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.\r For a description of this vulnerability, see the .\r Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-22T17:15:12.583Z","modified":"2026-09-01T20:05:41.7190807Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"UBUNTU-CVE-2025-20128","description":"A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.","status":"published","published":"2025-01-23T00:00:00Z","modified":"2026-04-22T15:32:53.774619Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"CLSA-2025-1756202550","title":"Fix of 9 CVEs","description":"   * Update up to 1.4.3 LTS\n     - CVE-2025-20260\n     - CVE-2025-20234\n     - CVE-2025-20128\n     - CVE-2024-20505, CVE-2024-20506\n     - CVE-2023-20197\n     - CVE-2023-20212\n     - CVE-2023-20032\n     - CVE-2023-20052","status":"published","published":"2025-08-26T10:02:35Z","modified":"2026-06-04T10:04:10.772300369Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1756409595","title":"clamav: Fix of 4 CVEs","description":"- Update to 1.4.3 LTS\n- CVE-2025-20260: Fixed a possible buffer overflow write bug in\n  the PDF file parser\n- CVE-2025-20234: Fixed a possible buffer overflow read bug in\n  the UDF file parser\n- CVE-2025-20128: Fixed a possible buffer overflow read bug in\n  the OLE2 file parser\n- CVE-2024-20506: Changed the logging module to disable following\n  symlinks on Linux and Unix systems so as to prevent an attacker\n  with existing access to the 'clamd' or 'freshclam' services from\n  using a symlink to corrupt system files","status":"published","published":"2025-08-28T19:33:18Z","modified":"2026-10-21T10:47:55.344470814Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1756923561","title":"clamav: Fix of 8 CVEs","description":"- Update to 1.0.9 LTS version\n- CVE-2025-20260: Fixed a possible buffer overflow write bug in\n  the PDF file parser\n- CVE-2025-20128: Fixed a possible buffer overflow read bug in\n  the OLE2 file parser\n- CVE-2024-20506: Changed the logging module to disable following\n  symlinks on Linux and Unix systems so as to prevent an attacker\n  with existing access to the 'clamd' or 'freshclam' services from\n  using a symlink to corrupt system files\n- CVE-2024-20290: Fixed a possible heap overflow read bug in\n  the OLE2 file parser\n- CVE-2024-20328: Fixed a possible command injection in the\n  'VirusEvent' feature of the clamd service\n- CVE-2023-20197: Fixed a possible denial of service in the\n  HFS+ parser\n- CVE-2023-20212: Fixed a possible DoS in the AutoIT file\n  parser\n- CVE-2023-20052: Fixed a possible remote information leak\n  in the DMG file parser","status":"published","published":"2025-09-03T18:19:25Z","modified":"2026-10-21T10:47:48.42966016Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"DLA-4292-1","title":"clamav - security update","status":"published","published":"2025-09-04T00:00:00Z","modified":"2026-03-09T02:08:48.142941Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0031","title":"Updated clamav packages fix security vulnerability","description":"ClamAV OLE2 File Format Decryption Denial of Service Vulnerability.\n(CVE-2025-20128)\n","status":"published","published":"2025-01-31T20:54:03Z","modified":"2026-04-16T04:43:25.685112198Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:14683-1","title":"clamav-1.4.2-1.1 on GA media","description":"These are all security issues fixed in the clamav-1.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-23T00:00:00Z","modified":"2026-02-04T03:21:33.966204Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0325-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nNew version 1.4.2:\n\n  * CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow\n    read bug in the OLE2 file parser that could cause a\n    denial-of-service (DoS) condition.  \n\n- Start clamonacc with --fdpass to avoid errors due to\n  clamd not being able to access user files. (bsc#1232242)\n\n- New version 1.4.1:\n\n  * https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html\n\n- New version 1.4.0:\n\n  * Added support for extracting ALZ archives.\n  * Added support for extracting LHA/LZH archives.\n  * Added the ability to disable image fuzzy hashing, if needed.\n    For context, image fuzzy hashing is a detection mechanism\n    useful for identifying malware by matching images included with\n    the malware or phishing email/document.\n  * https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html\n\n- New version 1.3.2:\n\n  * CVE-2024-20506: Changed the logging module to disable following\n    symlinks on Linux and Unix systems so as to prevent an attacker\n    with existing access to the 'clamd' or 'freshclam' services from\n    using a symlink to corrupt system files.\n  * CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF\n    file parser that could cause a denial-of-service condition.\n  * Removed unused Python modules from freshclam tests including\n    deprecated 'cgi' module that is expected to cause test failures in\n    Python 3.13.\n  * Fix unit test caused by expiring signing certificate.\n  * Fixed a build issue on Windows with newer versions of Rust. Also\n    upgraded GitHub Actions imports to fix CI failures.\n  * Fixed an unaligned pointer dereference issue on select architectures.\n  * Fixes to Jenkins CI pipeline.\n  \n\n- New Version: 1.3.1:\n\n  * CVE-2024-20380: Fixed a possible crash in the HTML file parser\n    that could cause a denial-of-service (DoS) condition.\n  * Updated select Rust dependencies to the latest versions.\n  * Fixed a bug causing some text to be truncated when converting\n    from UTF-16.\n  * Fixed assorted complaints identified by Coverity static\n    analysis.\n  * Fixed a bug causing CVDs downloaded by the DatabaseCustomURL\n  * Added the new 'valhalla' database name to the list of optional\n    databases in preparation for future work.\n\n- New version: 1.3.0:\n\n  * Added support for extracting and scanning attachments found in\n    Microsoft OneNote section files. OneNote parsing will be\n    enabled by default, but may be optionally disabled.\n  * Added file type recognition for compiled Python ('.pyc') files.\n  * Improved support for decrypting PDFs with empty passwords.\n  * Fixed a warning when scanning some HTML files.\n  * ClamOnAcc: Fixed an infinite loop when a watched directory\n    does not exist.\n  * ClamOnAcc: Fixed an infinite loop when a file has been deleted\n    before a scan.\n\n- New version: 1.2.0:\n\n  * Added support for extracting Universal Disk Format (UDF)\n    partitions.\n  * Added an option to customize the size of ClamAV's clean file\n    cache.\n  * Raised the MaxScanSize limit so the total amount of data\n    scanned when scanning a file or archive may exceed 4 gigabytes.\n  * Added ability for Freshclam to use a client certificate PEM\n    file and a private key PEM file for authentication to a private\n    mirror.\n  * Fix an issue extracting files from ISO9660 partitions where the\n    files are listed in the plain ISO tree and there also exists an\n    empty Joliet tree.\n  * PID and socket are now located under /run/clamav/clamd.pid and\n    /run/clamav/clamd.sock .\n  * bsc#1211594: Fixed an issue where ClamAV does not abort the\n    signature load process after partially loading an invalid\n    signature.\n\n- New version 1.1.0:\n\n  * https://blog.clamav.net/2023/05/clamav-110-released.html\n  * Added the ability to extract images embedded in HTML CSS\n    \u003cstyle\u003e blocks.\n  * Updated to Sigtool so that the '--vba' option will extract VBA\n    code from Microsoft Office documents the same way that\n    libclamav extracts VBA.\n  * Added a new option --fail-if-cvd-older-than=days to clamscan\n    and clamd, and FailIfCvdOlderThan to clamd.conf\n  * Added a new function 'cl_cvdgetage()' to the libclamav API.\n  * Added a new function 'cl_engine_set_clcb_vba()' to the\n    libclamav API.\n- bsc#1180296: Integrate clamonacc as a service.\n- New version 1.0.1 LTS (including changes in 0.104 and 0.105):\n  * As of ClamAV 0.104, CMake is required to build ClamAV.\n  * As of ClamAV 0.105, Rust is now required to compile ClamAV.\n  * Increased the default limits for file and scan size:\n    * MaxScanSize: 100M to 400M\n    * MaxFileSize: 25M to 100M\n    * StreamMaxLength: 25M to 100M\n    * PCREMaxFileSize: 25M to 100M\n    * MaxEmbeddedPE: 10M to 40M\n    * MaxHTMLNormalize: 10M to 40M\n    * MaxScriptNormalize: 5M to 20M\n    * MaxHTMLNoTags: 2M to 8M\n  * Added image fuzzy hash subsignatures for logical signatures.\n  * Support for decrypting read-only OLE2-based XLS files that are\n    encrypted with the default password.\n  * Overhauled the implementation of the all-match feature.\n  * Added a new callback to the public API for inspecting file\n    content during a scan at each layer of archive extraction.\n  * Added a new function to the public API for unpacking CVD\n    signature archives.\n  * The option to build with an external TomsFastMath library has\n    been removed. ClamAV requires non-default build options for\n    TomsFastMath to support bigger floating point numbers.\n  * For a full list of changes see the release announcements:\n    * https://blog.clamav.net/2022/11/clamav-100-lts-released.html\n    * https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html\n    * https://blog.clamav.net/2021/09/clamav-01040-released.html\n- Build clamd with systemd support.\n\n* CVE-2023-20197: Fixed a possible denial of service vulnerability in\n  the HFS+ file parser. (bsc#1214342)\n* CVE-2018-14679: Fixed that an issue was discovered in mspack/chmd.c\n  in libmspack before 0.7alpha. There isan off-by-one error in the CHM\n  PMGI/PMGL chunk number validity checks, which could lead to denial of\n  service (uninitialized da (bsc#1103032)\n  \n- Package huge .html documentation in a separate subpackage.\n\n- Update to 0.103.7 (bsc#1202986)\n\n  - Zip parser: tolerate 2-byte overlap in file entries\n  - Fix bug with logical signature Intermediates feature\n  - Update to UnRAR v6.1.7\n  - Patch UnRAR: allow skipping files in solid archives\n  - Patch UnRAR: limit dict winsize to 1GB\n\n- Use a split-provides for clamav-milter instead of recommending it.\n- Package clamav-milter in a subpackage\n- Remove virus signatures upon uninstall\n- Check for database existence before starting clamd\n- Restart clamd when it exits\n- Don't daemonize freshclam, but use a systemd timer instead to\n  trigger updates\n","status":"published","published":"2025-02-03T09:39:04Z","modified":"2026-02-04T03:51:11.22462Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0327-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nNew version 1.4.2:\n\n  * CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow\n    read bug in the OLE2 file parser that could cause a\n    denial-of-service (DoS) condition.  \n\n- Start clamonacc with --fdpass to avoid errors due to\n  clamd not being able to access user files. (bsc#1232242)\n\n- New version 1.4.1:\n\n  * https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html\n\n- New version 1.4.0:\n\n  * Added support for extracting ALZ archives.\n  * Added support for extracting LHA/LZH archives.\n  * Added the ability to disable image fuzzy hashing, if needed.\n    For context, image fuzzy hashing is a detection mechanism\n    useful for identifying malware by matching images included with\n    the malware or phishing email/document.\n  * https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html\n\n- New version 1.3.2:\n\n  * CVE-2024-20506: Changed the logging module to disable following\n    symlinks on Linux and Unix systems so as to prevent an attacker\n    with existing access to the 'clamd' or 'freshclam' services from\n    using a symlink to corrupt system files.\n  * CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF\n    file parser that could cause a denial-of-service condition.\n  * Removed unused Python modules from freshclam tests including\n    deprecated 'cgi' module that is expected to cause test failures in\n    Python 3.13.\n  * Fix unit test caused by expiring signing certificate.\n  * Fixed a build issue on Windows with newer versions of Rust. Also\n    upgraded GitHub Actions imports to fix CI failures.\n  * Fixed an unaligned pointer dereference issue on select architectures.\n  * Fixes to Jenkins CI pipeline.\n  \n\n- New Version: 1.3.1:\n\n  * CVE-2024-20380: Fixed a possible crash in the HTML file parser\n    that could cause a denial-of-service (DoS) condition.\n  * Updated select Rust dependencies to the latest versions.\n  * Fixed a bug causing some text to be truncated when converting\n    from UTF-16.\n  * Fixed assorted complaints identified by Coverity static\n    analysis.\n  * Fixed a bug causing CVDs downloaded by the DatabaseCustomURL\n  * Added the new 'valhalla' database name to the list of optional\n    databases in preparation for future work.\n\n- New version: 1.3.0:\n\n  * Added support for extracting and scanning attachments found in\n    Microsoft OneNote section files. OneNote parsing will be\n    enabled by default, but may be optionally disabled.\n  * Added file type recognition for compiled Python ('.pyc') files.\n  * Improved support for decrypting PDFs with empty passwords.\n  * Fixed a warning when scanning some HTML files.\n  * ClamOnAcc: Fixed an infinite loop when a watched directory\n    does not exist.\n  * ClamOnAcc: Fixed an infinite loop when a file has been deleted\n    before a scan.\n\n- New version: 1.2.0:\n\n  * Added support for extracting Universal Disk Format (UDF)\n    partitions.\n  * Added an option to customize the size of ClamAV's clean file\n    cache.\n  * Raised the MaxScanSize limit so the total amount of data\n    scanned when scanning a file or archive may exceed 4 gigabytes.\n  * Added ability for Freshclam to use a client certificate PEM\n    file and a private key PEM file for authentication to a private\n    mirror.\n  * Fix an issue extracting files from ISO9660 partitions where the\n    files are listed in the plain ISO tree and there also exists an\n    empty Joliet tree.\n  * PID and socket are now located under /run/clamav/clamd.pid and\n    /run/clamav/clamd.sock .\n  * bsc#1211594: Fixed an issue where ClamAV does not abort the\n    signature load process after partially loading an invalid\n    signature.\n\n- New version 1.1.0:\n\n  * https://blog.clamav.net/2023/05/clamav-110-released.html\n  * Added the ability to extract images embedded in HTML CSS\n    \u003cstyle\u003e blocks.\n  * Updated to Sigtool so that the '--vba' option will extract VBA\n    code from Microsoft Office documents the same way that\n    libclamav extracts VBA.\n  * Added a new option --fail-if-cvd-older-than=days to clamscan\n    and clamd, and FailIfCvdOlderThan to clamd.conf\n  * Added a new function 'cl_cvdgetage()' to the libclamav API.\n  * Added a new function 'cl_engine_set_clcb_vba()' to the\n    libclamav API.\n- bsc#1180296: Integrate clamonacc as a service.\n- New version 1.0.1 LTS (including changes in 0.104 and 0.105):\n  * As of ClamAV 0.104, CMake is required to build ClamAV.\n  * As of ClamAV 0.105, Rust is now required to compile ClamAV.\n  * Increased the default limits for file and scan size:\n    * MaxScanSize: 100M to 400M\n    * MaxFileSize: 25M to 100M\n    * StreamMaxLength: 25M to 100M\n    * PCREMaxFileSize: 25M to 100M\n    * MaxEmbeddedPE: 10M to 40M\n    * MaxHTMLNormalize: 10M to 40M\n    * MaxScriptNormalize: 5M to 20M\n    * MaxHTMLNoTags: 2M to 8M\n  * Added image fuzzy hash subsignatures for logical signatures.\n  * Support for decrypting read-only OLE2-based XLS files that are\n    encrypted with the default password.\n  * Overhauled the implementation of the all-match feature.\n  * Added a new callback to the public API for inspecting file\n    content during a scan at each layer of archive extraction.\n  * Added a new function to the public API for unpacking CVD\n    signature archives.\n  * The option to build with an external TomsFastMath library has\n    been removed. ClamAV requires non-default build options for\n    TomsFastMath to support bigger floating point numbers.\n  * For a full list of changes see the release announcements:\n    * https://blog.clamav.net/2022/11/clamav-100-lts-released.html\n    * https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html\n    * https://blog.clamav.net/2021/09/clamav-01040-released.html\n- Build clamd with systemd support.\n\n* CVE-2023-20197: Fixed a possible denial of service vulnerability in\n  the HFS+ file parser. (bsc#1214342)\n* CVE-2018-14679: Fixed that an issue was discovered in mspack/chmd.c\n  in libmspack before 0.7alpha. There isan off-by-one error in the CHM\n  PMGI/PMGL chunk number validity checks, which could lead to denial of\n  service (uninitialized da (bsc#1103032)\n  \n- Package huge .html documentation in a separate subpackage.\n\n- Update to 0.103.7 (bsc#1202986)\n\n  - Zip parser: tolerate 2-byte overlap in file entries\n  - Fix bug with logical signature Intermediates feature\n  - Update to UnRAR v6.1.7\n  - Patch UnRAR: allow skipping files in solid archives\n  - Patch UnRAR: limit dict winsize to 1GB\n\n- Use a split-provides for clamav-milter instead of recommending it.\n- Package clamav-milter in a subpackage\n- Remove virus signatures upon uninstall\n- Check for database existence before starting clamd\n- Restart clamd when it exits\n- Don't daemonize freshclam, but use a systemd timer instead to\n  trigger updates\n","status":"published","published":"2025-02-03T09:39:39Z","modified":"2025-05-02T04:29:53.295121Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0328-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nNew version 1.4.2:\n\n  * CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow\n    read bug in the OLE2 file parser that could cause a\n    denial-of-service (DoS) condition.  \n\n- Start clamonacc with --fdpass to avoid errors due to\n  clamd not being able to access user files. (bsc#1232242)\n\n- New version 1.4.1:\n\n  * https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html\n\n- New version 1.4.0:\n\n  * Added support for extracting ALZ archives.\n  * Added support for extracting LHA/LZH archives.\n  * Added the ability to disable image fuzzy hashing, if needed.\n    For context, image fuzzy hashing is a detection mechanism\n    useful for identifying malware by matching images included with\n    the malware or phishing email/document.\n  * https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html\n\n- New version 1.3.2:\n\n  * CVE-2024-20506: Changed the logging module to disable following\n    symlinks on Linux and Unix systems so as to prevent an attacker\n    with existing access to the 'clamd' or 'freshclam' services from\n    using a symlink to corrupt system files.\n  * CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF\n    file parser that could cause a denial-of-service condition.\n  * Removed unused Python modules from freshclam tests including\n    deprecated 'cgi' module that is expected to cause test failures in\n    Python 3.13.\n  * Fix unit test caused by expiring signing certificate.\n  * Fixed a build issue on Windows with newer versions of Rust. Also\n    upgraded GitHub Actions imports to fix CI failures.\n  * Fixed an unaligned pointer dereference issue on select architectures.\n  * Fixes to Jenkins CI pipeline.\n  \n\n- New Version: 1.3.1:\n\n  * CVE-2024-20380: Fixed a possible crash in the HTML file parser\n    that could cause a denial-of-service (DoS) condition.\n  * Updated select Rust dependencies to the latest versions.\n  * Fixed a bug causing some text to be truncated when converting\n    from UTF-16.\n  * Fixed assorted complaints identified by Coverity static\n    analysis.\n  * Fixed a bug causing CVDs downloaded by the DatabaseCustomURL\n  * Added the new 'valhalla' database name to the list of optional\n    databases in preparation for future work.\n\n- New version: 1.3.0:\n\n  * Added support for extracting and scanning attachments found in\n    Microsoft OneNote section files. OneNote parsing will be\n    enabled by default, but may be optionally disabled.\n  * Added file type recognition for compiled Python ('.pyc') files.\n  * Improved support for decrypting PDFs with empty passwords.\n  * Fixed a warning when scanning some HTML files.\n  * ClamOnAcc: Fixed an infinite loop when a watched directory\n    does not exist.\n  * ClamOnAcc: Fixed an infinite loop when a file has been deleted\n    before a scan.\n\n- New version: 1.2.0:\n\n  * Added support for extracting Universal Disk Format (UDF)\n    partitions.\n  * Added an option to customize the size of ClamAV's clean file\n    cache.\n  * Raised the MaxScanSize limit so the total amount of data\n    scanned when scanning a file or archive may exceed 4 gigabytes.\n  * Added ability for Freshclam to use a client certificate PEM\n    file and a private key PEM file for authentication to a private\n    mirror.\n  * Fix an issue extracting files from ISO9660 partitions where the\n    files are listed in the plain ISO tree and there also exists an\n    empty Joliet tree.\n  * PID and socket are now located under /run/clamav/clamd.pid and\n    /run/clamav/clamd.sock .\n  * bsc#1211594: Fixed an issue where ClamAV does not abort the\n    signature load process after partially loading an invalid\n    signature.\n\n- New version 1.1.0:\n\n  * https://blog.clamav.net/2023/05/clamav-110-released.html\n  * Added the ability to extract images embedded in HTML CSS\n    \u003cstyle\u003e blocks.\n  * Updated to Sigtool so that the '--vba' option will extract VBA\n    code from Microsoft Office documents the same way that\n    libclamav extracts VBA.\n  * Added a new option --fail-if-cvd-older-than=days to clamscan\n    and clamd, and FailIfCvdOlderThan to clamd.conf\n  * Added a new function 'cl_cvdgetage()' to the libclamav API.\n  * Added a new function 'cl_engine_set_clcb_vba()' to the\n    libclamav API.\n- bsc#1180296: Integrate clamonacc as a service.\n- New version 1.0.1 LTS (including changes in 0.104 and 0.105):\n  * As of ClamAV 0.104, CMake is required to build ClamAV.\n  * As of ClamAV 0.105, Rust is now required to compile ClamAV.\n  * Increased the default limits for file and scan size:\n    * MaxScanSize: 100M to 400M\n    * MaxFileSize: 25M to 100M\n    * StreamMaxLength: 25M to 100M\n    * PCREMaxFileSize: 25M to 100M\n    * MaxEmbeddedPE: 10M to 40M\n    * MaxHTMLNormalize: 10M to 40M\n    * MaxScriptNormalize: 5M to 20M\n    * MaxHTMLNoTags: 2M to 8M\n  * Added image fuzzy hash subsignatures for logical signatures.\n  * Support for decrypting read-only OLE2-based XLS files that are\n    encrypted with the default password.\n  * Overhauled the implementation of the all-match feature.\n  * Added a new callback to the public API for inspecting file\n    content during a scan at each layer of archive extraction.\n  * Added a new function to the public API for unpacking CVD\n    signature archives.\n  * The option to build with an external TomsFastMath library has\n    been removed. ClamAV requires non-default build options for\n    TomsFastMath to support bigger floating point numbers.\n  * For a full list of changes see the release announcements:\n    * https://blog.clamav.net/2022/11/clamav-100-lts-released.html\n    * https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html\n    * https://blog.clamav.net/2021/09/clamav-01040-released.html\n- Build clamd with systemd support.\n\n* CVE-2023-20197: Fixed a possible denial of service vulnerability in\n  the HFS+ file parser. (bsc#1214342)\n* CVE-2018-14679: Fixed that an issue was discovered in mspack/chmd.c\n  in libmspack before 0.7alpha. There isan off-by-one error in the CHM\n  PMGI/PMGL chunk number validity checks, which could lead to denial of\n  service (uninitialized da (bsc#1103032)\n  \n- Package huge .html documentation in a separate subpackage.\n\n- Update to 0.103.7 (bsc#1202986)\n\n  - Zip parser: tolerate 2-byte overlap in file entries\n  - Fix bug with logical signature Intermediates feature\n  - Update to UnRAR v6.1.7\n  - Patch UnRAR: allow skipping files in solid archives\n  - Patch UnRAR: limit dict winsize to 1GB\n\n- Use a split-provides for clamav-milter instead of recommending it.\n- Package clamav-milter in a subpackage\n- Remove virus signatures upon uninstall\n- Check for database existence before starting clamd\n- Restart clamd when it exits\n- Don't daemonize freshclam, but use a systemd timer instead to\n  trigger updates\n","status":"published","published":"2025-02-03T09:39:50Z","modified":"2026-02-04T02:25:47.12925Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"USN-7229-1","title":"clamav vulnerability","description":"It was discovered that ClamAV incorrectly handled decrypting OLE2 content.\nA remote attacker could possibly use this issue to cause ClamAV to crash,\nresulting in a denial of service.\n","status":"published","published":"2025-01-27T15:06:38Z","modified":"2026-04-22T10:54:52.584726Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}