CVE-2020-37167: ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37167?
CVE-2020-37167 has a medium severity rating due to its potential for exploitation through improper input validation.
How do I fix CVE-2020-37167?
To fix CVE-2020-37167, upgrade ClamBC to version 0.102.1 or later.
What are the potential impacts of CVE-2020-37167?
The impacts of CVE-2020-37167 include the possibility of attackers executing arbitrary code through manipulated bytecode function names.
Is my version of ClamBC affected by CVE-2020-37167?
If you are using ClamBC version 0.102.0 or earlier, your version is affected by CVE-2020-37167.
What should I do if I can't upgrade to fix CVE-2020-37167?
If upgrading is not possible, consider implementing additional input validation or restricting the execution of all user-provided bytecode.