CVE-2022-20698
Clam AntiVirus (ClamAV) Denial of Service Vulnerability
- State
- Published
- Severity
- 7.5 High
- Published
- Jan 14, 2022
- Updated
- Nov 6, 2024
- Reserved
- Nov 2, 2021
Description
A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | cisco |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ClamAVCisco |
|
ClamAVCisco |
|
References
- https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.htmlvendor-advisory
- GLSA-202310-01vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.