CVE-2022-20803

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-20803

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-20803.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-20803

Published

2023-02-17T18:15:11.740Z

Modified

2026-03-13T05:25:38.479673Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that may result in a double-free. An attacker could exploit this vulnerability by submitting a crafted OLE2 file to be scanned by ClamAV on the affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.

References

Affected packages

Git / github.com/cisco-talos/clamav

Affected ranges

Type

GIT

Repo

https://github.com/cisco-talos/clamav

Events

Introduced

ba51bf8e644921a1592d2f3d280a2daa924acfd8

Fixed

52edc04710856c5b2d29b29edf7a4eea2e6096c3

Database specific

{
    "versions": [
        {
            "introduced": "0.104.0"
        },
        {
            "fixed": "0.104.3"
        }
    ]
}

Affected versions

clamav-0.*

clamav-0.104.0

clamav-0.104.1

clamav-0.104.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-20803.json"