CVE-2024-20505: ClamAV Memory Handling DoS
A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20505?
CVE-2024-20505 is considered a high severity vulnerability in ClamAV that could allow unauthenticated remote attackers to exploit the system.
How do I fix CVE-2024-20505?
To fix CVE-2024-20505, upgrade ClamAV to version 1.4.1 or later.
What versions of ClamAV are affected by CVE-2024-20505?
CVE-2024-20505 affects ClamAV versions 1.4.0, 1.3.2, all 1.2.x, all 1.0.6 and prior, as well as all 0.105.x versions.
Can CVE-2024-20505 be exploited remotely?
Yes, CVE-2024-20505 can be exploited by an unauthenticated remote attacker.
Is there a patch available for CVE-2024-20505?
Yes, a patch is available in ClamAV version 1.4.1 and beyond to mitigate CVE-2024-20505.