VulnerableCode Package Details - pkg:deb/debian/clamav@0.103.10%2Bdfsg-0%2Bdeb11u1

Search for packages

Vulnerability	Summary	Fixed by
VCID-5kba-63mx-hya7 Aliases: CVE-2026-20031	A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.	1.4.4+dfsg-1 Affected by 0 other vulnerabilities.
VCID-63vt-1nc8-6kfc Aliases: CVE-2025-20260	A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.	1.4.3+dfsg-1~deb12u2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-ggz7-h35v-p7ep Aliases: CVE-2024-20505	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could lead to arbitrary code execution.	1.4.3+dfsg-1~deb12u2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-vdhk-r67a-s3fr Aliases: CVE-2025-20128	A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.	1.4.3+dfsg-1~deb12u2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-wjvc-p75d-p3a9 Aliases: CVE-2024-20506	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could lead to arbitrary code execution.	1.4.3+dfsg-1~deb12u2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-5kba-63mx-hya7
Aliases:
CVE-2026-20031

A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

1.4.4+dfsg-1
Affected by 0 other vulnerabilities.

VCID-63vt-1nc8-6kfc
Aliases:
CVE-2025-20260

A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.

1.4.3+dfsg-1~deb12u2
Affected by 1 other vulnerability.

VCID-ggz7-h35v-p7ep
Aliases:
CVE-2024-20505

Multiple vulnerabilities have been discovered in ClamAV, the worst of which could lead to arbitrary code execution.

1.4.3+dfsg-1~deb12u2
Affected by 1 other vulnerability.

VCID-vdhk-r67a-s3fr
Aliases:
CVE-2025-20128

A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

1.4.3+dfsg-1~deb12u2
Affected by 1 other vulnerability.

VCID-wjvc-p75d-p3a9
Aliases:
CVE-2024-20506

Multiple vulnerabilities have been discovered in ClamAV, the worst of which could lead to arbitrary code execution.

1.4.3+dfsg-1~deb12u2
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
VCID-2aju-u36p-gug9	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution.	CVE-2022-20796
VCID-4z4r-2w8m-r7dz	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution.	CVE-2023-20032
VCID-d3u3-epeb-guh9	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution.	CVE-2023-20052
VCID-dn26-zfsc-ryec	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution.	CVE-2022-20785
VCID-fp31-7krz-abbs	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution.	CVE-2022-20770
VCID-kurn-1uay-qqap	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution.	CVE-2022-20792
VCID-mdfk-5ked-t3bu	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could lead to arbitrary code execution.	CVE-2023-20197
VCID-tzph-y73s-6qb9	Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution.	CVE-2022-20771

Vulnerability

Summary

Aliases

VCID-2aju-u36p-gug9