CVE-2025-4134: Lack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files

Published May 28, 2025

Updated

Lack of file validation in doupdatevps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof or tamper with the update file via an unverified file write.

Affected Software

1 affected component

Avast Business Antivirus for Linux

Remediation

Information

Fixed in V4.6 released 03/FEB/2025, ugrade to latest version.

Event History

May 28, 2025

CVE Published

via MITRE·01:53 PM

Data Sourced

via MITRE·01:53 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-4134?

CVE-2025-4134 is rated as a medium severity vulnerability due to its potential to allow local users to spoof or tamper with update files.

How do I fix CVE-2025-4134?

To fix CVE-2025-4134, ensure that file validation mechanisms are implemented in the update process to prevent unauthorized file modifications.

Who is affected by CVE-2025-4134?

CVE-2025-4134 affects users of Avast Business Antivirus for Linux 4.5 installed on Linux systems.

What impact does CVE-2025-4134 have on users?

CVE-2025-4134 can lead to untrusted file installations, potentially compromising system security.

Is there a patch available for CVE-2025-4134?

Currently, no specific patch has been released for CVE-2025-4134; users should monitor Avast for updates or implement temporary mitigation measures.