Log in Start free

Vulnerability · Published May 4, 2022 · Assigned by cisco

CVE-2022-20785ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022

High 7.5

In plain English

A high-severity memory leak in Cisco AMP for Endpoints from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.1% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)7.1%top 5.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12clamav0.103.6+dfsg-1DEBIAN-CVE-2022-20785
Debian:13clamav0.103.6+dfsg-1DEBIAN-CVE-2022-20785
Debian:14clamav0.103.6+dfsg-1DEBIAN-CVE-2022-20785
Ubuntu:22.04:LTSclamav0.103.6+dfsg-0ubuntu0.22.04.1USN-5423-1
Ubuntu:22.04:LTSclamav0.103.6+dfsg-0ubuntu0.22.04.1UBUNTU-CVE-2022-20785

Affected products (as reported)

VendorProductVersions
Cisco Cisco AMP for Endpoints n/a

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References