[Pkg-clamav-devel] Bug#1063479: clamav: CVE-2024-20290 CVE-2024-20328

[Salvatore Bonaccorso]

Source: clamav
Version: 1.0.4+dfsg-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 1.0.3+dfsg-1~deb12u1

Hi,

The following vulnerabilities were published for clamav.

CVE-2024-20290[0]:
| A vulnerability in the OLE2 file format parser of ClamAV could allow
| an unauthenticated, remote attacker to cause a denial of service
| (DoS) condition on an affected device.    This vulnerability is due
| to an incorrect check for end-of-string values during scanning,
| which may result in a heap buffer over-read. An attacker could
| exploit this vulnerability by submitting a crafted file containing
| OLE2 content to be scanned by ClamAV on an affected device. A
| successful exploit could allow the attacker to cause the ClamAV
| scanning process to terminate, resulting in a DoS condition on the
| affected software and consuming available system resources.    For a
| description of this vulnerability, see the ClamAV blog .


CVE-2024-20328[1]:
| Fixed a possible command injection vulnerability in the "VirusEvent"
| feature of ClamAV's ClamD service.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-20290
    https://www.cve.org/CVERecord?id=CVE-2024-20290
[1] https://security-tracker.debian.org/tracker/CVE-2024-20328
    https://www.cve.org/CVERecord?id=CVE-2024-20328
[2] https://blog.clamav.net/2023/11/clamav-130-122-105-released.html

Regards,
Salvatore