{"id":"USN-6636-1","aliases":[],"status":"published","title":"clamav vulnerabilities","description":"It was discovered that ClamAV incorrectly handled parsing certain OLE2\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\ncrash, resulting in a denial of service. (CVE-2024-20290)\n\nAmit Schendel discovered that the ClamAV ClamD service incorrectly handled\nthe VirusEvent feature. An attacker able to connect to ClamD could possibly\nuse this issue to execute arbitrary code. (CVE-2024-20328)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-02-14T16:11:25.366081Z","modified":"2026-02-04T02:17:07Z","fixes":[{"ecosystem":"Ubuntu:23.10","package":"clamav","fixed_in":["1.0.5+dfsg-0ubuntu0.23.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:23.10","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5+dfsg-0ubuntu0.23.10.1"}]}],"versions":["0.103.8+dfsg-0ubuntu1","0.103.8+dfsg-0ubuntu2","1.0.2+dfsg-1ubuntu1","1.0.4+dfsg-0ubuntu0.23.10.1"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-6636-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-20290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-20328","tags":["report"]}],"sources":{"osv":[{"id":"USN-6636-1","title":"clamav vulnerabilities","description":"It was discovered that ClamAV incorrectly handled parsing certain OLE2\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\ncrash, resulting in a denial of service. (CVE-2024-20290)\n\nAmit Schendel discovered that the ClamAV ClamD service incorrectly handled\nthe VirusEvent feature. An attacker able to connect to ClamD could possibly\nuse this issue to execute arbitrary code. (CVE-2024-20328)\n","status":"published","published":"2024-02-14T16:11:25.366081Z","modified":"2026-02-04T02:17:07.971953Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}