CVE-2023-20032: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file p

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco secure endpointbefore 1.20.2
• cisco secure endpointbefore 1.21.1
• cisco secure endpointbefore 7.5.9
• cisco secure endpoint8.0.1.21160 and later · before 8.1.5
• cisco secure endpoint private cloudbefore 3.6.0
• cisco web security appliancebefore 12.5.6
• cisco web security appliance14.0.0 and later · before 14.0.4-005
• cisco web security appliance14.5.0 and later · before 14.5.1-013
• cisco web security appliance15.0.0 and later · before 15.0.0-254
• clamav clamavup to 0.103.7 inclusive
• clamav clamav0.104.0 and later · up to 0.105.1 inclusive
• clamav clamav1.0.0
• stormshield stormshield network security3.0.0 and later · before 3.7.35
• stormshield stormshield network security3.8.0 and later · before 3.11.23
• stormshield stormshield network security4.3.0 and later · before 4.3.17
• stormshield stormshield network security4.4.0 and later · before 4.6.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (cisco). Independent of NVD's CPE analysis and usually ahead of it.

• Cisco Cisco Secure Endpoint

  • 6.1.9, 6.2.5, 6.3.7, 6.3.3, 7.0.5, 7.1.1, 1.12.1, 1.12.2, 1.12.3, 1.12.7, 1.12.4, 1.11.0 … (+10)affected

• Cisco Cisco Secure Endpoint Private Cloud Administration Portal

  • N/Aaffected

• Cisco Cisco Secure Web Appliance

  • 11.7.0-406, 11.7.0-418, 11.7.1-049, 11.7.1-006, 11.7.1-020, 11.7.2-011, 11.8.0-414, 11.8.1-023, 11.8.3-018, 11.8.3-021, 12.0.1-268, 12.0.3-007 … (+7)affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2024-20328ClamAV VirusEvent File Processing Command Injection Vulnerability
  46Plan
• CVE-2017-12379ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a
  43Plan
• CVE-2006-1615Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute
  43Plan

Published before and after this one in the same product

• ← EarlierCVE-2022-20792Aug 10, 2022 · A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 a
  31Monitor
• ← EarlierCVE-2022-20803Feb 17, 2023 · ClamAV Double-free Vulnerability in the OLE2 File Parser
  30Monitor
• Later →CVE-2023-20052Mar 1, 2023 · On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of Cl
  23Monitor

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.