CVE-2022-20698

A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
Affected Products (NVD)
VendorProductVersion
clamavclamav
𝑥
< 0.103.5
clamavclamav
0.104.0 ≤
𝑥
< 0.104.2
debiandebian_linux
9.0
debiandebian_linux
10.0
debiandebian_linux
11.0
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
20.04
canonicalubuntu_linux
20.10
canonicalubuntu_linux
21.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
clamav
bookworm
1.0.5+dfsg-1~deb12u1
fixed
bullseye
0.103.10+dfsg-0+deb11u1
fixed
sid
1.4.1+dfsg-1
fixed
stretch
postponed
trixie
1.4.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
clamav
bionic
Fixed 0.103.5+dfsg-0ubuntu0.18.04.1
released
focal
Fixed 0.103.5+dfsg-1~20.04.1
released
hirsute
Fixed 0.103.5+dfsg-1~21.04.1
released
impish
Fixed 0.103.5+dfsg-1~21.10.1
released
jammy
not-affected
trusty
Fixed 0.103.5+dfsg-0ubuntu0.14.04.1+esm1
released
xenial
Fixed 0.103.5+dfsg-0ubuntu0.16.04.1+esm1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
clamav
suse enterprise desktop 15 SP3
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP4
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP5
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise desktop 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise sap 15
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP1
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP2
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP3
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP4
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP5
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise sap 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise server 15
0.103.5-3.35.1
fixed
suse enterprise server 15 SP1
0.103.5-3.35.1
fixed
suse enterprise server 15 SP2
0.103.5-3.35.1
fixed
suse enterprise server 15 SP3
0.103.5-3.35.1
fixed
suse enterprise server 15 SP4
0.103.5-3.35.1
fixed
suse enterprise server 15 SP5
0.103.5-3.35.1
fixed
suse enterprise server 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise server 15 SP7
1.4.2-150600.18.9.3
fixed
clamav-devel
suse enterprise desktop 15 SP3
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP4
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP5
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise desktop 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise sap 15
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP1
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP2
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP3
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP4
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP5
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise sap 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise server 15
0.103.5-3.35.1
fixed
suse enterprise server 15 SP1
0.103.5-3.35.1
fixed
suse enterprise server 15 SP2
0.103.5-3.35.1
fixed
suse enterprise server 15 SP3
0.103.5-3.35.1
fixed
suse enterprise server 15 SP4
0.103.5-3.35.1
fixed
suse enterprise server 15 SP5
0.103.5-3.35.1
fixed
suse enterprise server 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise server 15 SP7
1.4.2-150600.18.9.3
fixed
clamav-docs-html
suse enterprise desktop 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise sap 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise server 15 SP7
1.4.2-150600.18.9.3
fixed
clamav-milter
suse enterprise desktop 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise sap 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise server 15 SP7
1.4.2-150600.18.9.3
fixed
libclamav12
suse enterprise desktop 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise sap 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise server 15 SP7
1.4.2-150600.18.9.3
fixed
libclamav9
suse enterprise desktop 15 SP3
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP4
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP5
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise sap 15
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP1
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP2
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP3
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP4
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP5
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise server 15
0.103.5-3.35.1
fixed
suse enterprise server 15 SP1
0.103.5-3.35.1
fixed
suse enterprise server 15 SP2
0.103.5-3.35.1
fixed
suse enterprise server 15 SP3
0.103.5-3.35.1
fixed
suse enterprise server 15 SP4
0.103.5-3.35.1
fixed
suse enterprise server 15 SP5
0.103.5-3.35.1
fixed
suse enterprise server 15 SP6
0.103.11-150600.16.7
fixed
libclammspack0
suse enterprise desktop 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise sap 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise server 15 SP7
1.4.2-150600.18.9.3
fixed
libfreshclam2
suse enterprise desktop 15 SP3
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP4
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP5
0.103.5-3.35.1
fixed
suse enterprise desktop 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise sap 15
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP1
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP2
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP3
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP4
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP5
0.103.5-3.35.1
fixed
suse enterprise sap 15 SP6
0.103.11-150600.16.7
fixed
suse enterprise server 15
0.103.5-3.35.1
fixed
suse enterprise server 15 SP1
0.103.5-3.35.1
fixed
suse enterprise server 15 SP2
0.103.5-3.35.1
fixed
suse enterprise server 15 SP3
0.103.5-3.35.1
fixed
suse enterprise server 15 SP4
0.103.5-3.35.1
fixed
suse enterprise server 15 SP5
0.103.5-3.35.1
fixed
suse enterprise server 15 SP6
0.103.11-150600.16.7
fixed
libfreshclam3
suse enterprise desktop 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise sap 15 SP7
1.4.2-150600.18.9.3
fixed
suse enterprise server 15 SP7
1.4.2-150600.18.9.3
fixed
Common Weakness Enumeration
References
https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html
https://security.gentoo.org/glsa/202310-01
https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html
https://security.gentoo.org/glsa/202310-01