CVE-2022-20771

CVE	CVE-2022-20771
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-05-04 17:15:00 UTC
Updated	2023-11-07 03:42:00 UTC
Description	On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in the TIFF file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Problem Types: NVD-CWE-noinfo

Type	Vendor	Product	Version	Update	Edition	Language
Application	Cisco	Secure Endpoint	All	All	All	All
Application	Cisco	Secure Endpoint	All	All	All	All
Application	Cisco	Secure Endpoint	All	All	All	All
Application	Clamav	Clamav	All	All	All	All
Application	Clamav	Clamav	All	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Fedoraproject	Fedora	34	All	All	All
Operating System	Fedoraproject	Fedora	35	All	All	All
Operating System	Fedoraproject	Fedora	36	All	All	All

Reference	Source	Link	Tags
20220504 ClamAV TIFF File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022	CISCO	tools.cisco.com
[SECURITY] Fedora 35 Update: clamav-0.103.6-1.fc35 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
ClamAV: Multiple Vulnerabilities (GLSA 202310-01) — Gentoo security	GENTOO	security.gentoo.org
[SECURITY] [DLA 3042-1] clamav security update	MLIST	lists.debian.org
[SECURITY] Fedora 35 Update: clamav-0.103.6-1.fc35 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 36 Update: clamav-0.103.6-1.fc36 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 34 Update: clamav-0.103.6-1.fc34 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 34 Update: clamav-0.103.6-1.fc34 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 36 Update: clamav-0.103.6-1.fc36 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

179350 Debian Security Update for clamav (DLA 3042-1)
180861 Debian Security Update for clamav (CVE-2022-20771)
198788 Ubuntu Security Notification for ClamAV Vulnerabilities (USN-5423-1)
282688 Fedora Security Update for clamav (FEDORA-2022-a910a41a17)
282689 Fedora Security Update for clamav (FEDORA-2022-0ac71a8f3a)
282704 Fedora Security Update for clamav (FEDORA-2022-b8691af27b)
354029 Amazon Linux Security Advisory for clamav : ALAS-2022-1621
354308 Amazon Linux Security Advisory for clamav : ALAS2022-2022-090
354456 Amazon Linux Security Advisory for clamav : ALAS2022-2022-229
354544 Amazon Linux Security Advisory for clamav : ALAS-2022-229
355183 Amazon Linux Security Advisory for clamav : ALAS2023-2023-052
500101 Alpine Linux Security Update for clamav
690872 Free Berkeley Software Distribution (FreeBSD) Security Update for clamav (b2407db1-d79f-11ec-a15f-589cfc0f81b0)
710761 Gentoo Linux ClamAV Multiple Vulnerabilities (GLSA 202310-01)
752118 SUSE Enterprise Linux Security Update for clamav (SUSE-SU-2022:1644-1)
752121 SUSE Enterprise Linux Security Update for clamav (SUSE-SU-2022:1647-1)
901323 Common Base Linux Mariner (CBL-Mariner) Security Update for clamav (9674)
901852 Common Base Linux Mariner (CBL-Mariner) Security Update for clamav (9667)
902221 Common Base Linux Mariner (CBL-Mariner) Security Update for clamav (9674-1)
902390 Common Base Linux Mariner (CBL-Mariner) Security Update for clamav (9667-1)