CVE-2020-3327
Summary
| CVE | CVE-2020-3327 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-05-13 03:15:00 UTC |
| Updated | 2023-11-07 03:22:00 UTC |
| Description | A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 19.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 20.04 | All | All | All |
| Application | Cisco | Clam Antivirus | All | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 30 | All | All | All |
| Operating System | Fedoraproject | Fedora | 31 | All | All | All |
| Operating System | Fedoraproject | Fedora | 32 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 31 Update: clamav-0.102.4-1.fc31 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] [DLA 2215-1] clamav security update | MLIST | lists.debian.org | |
| ClamAV® blog: ClamAV 0.102.3 security patch released | CISCO | blog.clamav.net | Vendor Advisory |
| [SECURITY] Fedora 31 Update: clamav-0.102.3-1.fc31 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 32 Update: clamav-0.102.4-1.fc32 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 32 Update: clamav-0.102.3-1.fc32 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| USN-4370-2: ClamAV vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| USN-4435-2: ClamAV vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| USN-4370-1: ClamAV vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| [SECURITY] Fedora 30 Update: clamav-0.102.3-1.fc30 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 31 Update: clamav-0.102.3-1.fc31 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 32 Update: clamav-0.102.3-1.fc32 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| USN-4435-1: ClamAV vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| [SECURITY] Fedora 31 Update: clamav-0.102.4-1.fc31 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 30 Update: clamav-0.102.3-1.fc30 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| ClamAV: Multiple vulnerabilities (GLSA 202007-23) — Gentoo security | GENTOO | security.gentoo.org | |
| [SECURITY] Fedora 32 Update: clamav-0.102.4-1.fc32 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] [DLA 2314-1] clamav security update | MLIST | lists.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Special thanks to Daehui Chang and Fady Othman for helping identify the ARJ parsing vulnerability.
Legacy QID Mappings
- 500098 Alpine Linux Security Update for clamav
- 503823 Alpine Linux Security Update for clamav
- 690450 Free Berkeley Software Distribution (FreeBSD) Security Update for clamav (f7a02651-c798-11ea-81d6-6805cabe6ebb)
- 750483 OpenSUSE Security Update for clamav (openSUSE-SU-2020:2276-1)
- 750485 OpenSUSE Security Update for clamav (openSUSE-SU-2020:2268-1)