CVE-2022-20803: high-severity vulnerability in Cisco ClamAV
ClamAV Double-free Vulnerability in the OLE2 File Parser
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 1.1%
A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that may result in a double-free. An attacker could exploit this vulnerability by submitting a crafted OLE2 file to be scanned by ClamAV on the affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected products
Cisco · ClamAVRelated CVEs — Cisco ClamAV
In the same product, most dangerous first.
CVE-2024-20328MEDIUMClamAV VirusEvent File Processing Command Injection VulnerabilityEPSS 84.8%CVE-2020-3327HIGHClamAV ARJ Archive Parsing Denial of Service VulnerabilityEPSS 5.1%CVE-2020-3341HIGHClamAV PDF Parsing Denial of Service VulnerabilityEPSS 3.4%CVE-2020-3481HIGHClam AntiVirus (ClamAV) Software Null Pointer Dereference VulnerabilityEPSS 3.2%CVE-2022-20698HIGHClam AntiVirus (ClamAV) Denial of Service VulnerabilityEPSS 3.1%CVE-2021-1405HIGHClam AntiVirus (ClamAV) PDF Parser Denial of Service VulnerabilityEPSS 3.0%