Vulnerabilities > CVE-2023-20032 - Out-of-bounds Write vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

critical

NVD

Published: 2023-03-01

Updated: 2024-01-25

Summary

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"].

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco WEB Security Appliance 15.0.0 Cisco WEB Security Appliance 15.0.0-050 Cisco WEB Security Appliance * Cisco WEB Security Appliance 14.0.0 Cisco WEB Security Appliance 14.0.0-418 Cisco WEB Security Appliance 14.0.1-033 Cisco WEB Security Appliance 14.0.1-053 Cisco WEB Security Appliance 14.0.2 Cisco WEB Security Appliance 14.0.2-012 Cisco WEB Security Appliance - Cisco WEB Security Appliance 7.1.0 Cisco WEB Security Appliance 7.1.1 Cisco WEB Security Appliance 7.1.2 Cisco WEB Security Appliance 7.1.3 Cisco WEB Security Appliance 7.1.4 Cisco WEB Security Appliance 7.5.2-Hp2-303 Cisco WEB Security Appliance 7.7.0-608 Cisco WEB Security Appliance 7.7.5-835 Cisco WEB Security Appliance 8.0.5_Hp1 Cisco WEB Security Appliance 8.0.7 Cisco WEB Security Appliance 8.5.0-000 Cisco WEB Security Appliance 8.5.2-027 Cisco WEB Security Appliance 8.5.3-055 Cisco WEB Security Appliance 8.5.3-069 Cisco WEB Security Appliance 8.5_Base Cisco WEB Security Appliance 8.8.0-000 Cisco WEB Security Appliance 8.8.0-085 Cisco WEB Security Appliance 9.0.0-162 Cisco WEB Security Appliance 9.0.0-193 Cisco WEB Security Appliance 9.0.0-485 Cisco WEB Security Appliance 9.0.1-162 Cisco WEB Security Appliance 9.0_Base Cisco WEB Security Appliance 9.1.0-000 Cisco WEB Security Appliance 9.1.0-070 Cisco WEB Security Appliance 9.1.1-074 Cisco WEB Security Appliance 9.1.2-010 Cisco WEB Security Appliance 9.1.2-022 Cisco WEB Security Appliance 9.1.2-039 Cisco WEB Security Appliance 9.1_Base Cisco WEB Security Appliance 9.5.0-235 Cisco WEB Security Appliance 9.5.0-284 Cisco WEB Security Appliance 9.5.0-444 Cisco WEB Security Appliance 9.5_Base Cisco WEB Security Appliance 10.0.0-082 Cisco WEB Security Appliance 10.0.0-124 Cisco WEB Security Appliance 10.0.0-125 Cisco WEB Security Appliance 10.0.0-203 Cisco WEB Security Appliance 10.0.0-230 Cisco WEB Security Appliance 10.0.0-232 Cisco WEB Security Appliance 10.0.0-233 Cisco WEB Security Appliance 10.0_Base Cisco WEB Security Appliance 10.1.0 Cisco WEB Security Appliance 10.1.0-204 Cisco WEB Security Appliance 10.1.1-230 Cisco WEB Security Appliance 10.1.1-234 Cisco WEB Security Appliance 10.1.1-235 Cisco WEB Security Appliance 10.1.2-003 Cisco WEB Security Appliance 10.1.4-017 Cisco WEB Security Appliance 10.5.0 Cisco WEB Security Appliance 10.5.0-358 Cisco WEB Security Appliance 10.5.1 Cisco WEB Security Appliance 10.5.1-269 Cisco WEB Security Appliance 10.5.1-270 Cisco WEB Security Appliance 10.5.1-276 Cisco WEB Security Appliance 10.5.1-296 Cisco WEB Security Appliance 10.5.2 Cisco WEB Security Appliance 10.5.2-042 Cisco WEB Security Appliance 10.5.2-072 Cisco WEB Security Appliance 10.5.3-025 Cisco WEB Security Appliance 11.0.0 Cisco WEB Security Appliance 11.0.0-613 Cisco WEB Security Appliance 11.0.0-641 Cisco WEB Security Appliance 11.5.0-Fcs-442 Cisco WEB Security Appliance 11.5.0-Fcs-581 Cisco WEB Security Appliance 11.5.0-Fcs-614 Cisco WEB Security Appliance 11.5.1-Fcs-115 Cisco WEB Security Appliance 11.5.1-Fcs-124 Cisco WEB Security Appliance 11.5.1-Fcs-125 Cisco WEB Security Appliance 11.7.0 Cisco WEB Security Appliance 11.7.0-256 Cisco WEB Security Appliance 11.7.0-Fcs-334 Cisco WEB Security Appliance 11.7.2-011 Cisco WEB Security Appliance 11.8.0 Cisco WEB Security Appliance 11.8.0-382 Cisco WEB Security Appliance 11.8.0-429 Cisco WEB Security Appliance 11.8.0-453 Cisco WEB Security Appliance 12.0 Cisco WEB Security Appliance 12.0.1-268 Cisco WEB Security Appliance 12.0.5-011 Cisco WEB Security Appliance 12.5 Cisco WEB Security Appliance 12.5.0-722 Cisco WEB Security Appliance 12.5.1-011 Cisco WEB Security Appliance 12.5.1-043 Cisco WEB Security Appliance 12.5.2-011 Cisco WEB Security Appliance 12.5.4-005 Cisco Secure Endpoint Private Cloud * Cisco Secure Endpoint 8.0.1.21160 Cisco Secure Endpoint 8.1.3 Cisco Secure Endpoint 8.1.3.21242 Cisco Secure Endpoint - Cisco Secure Endpoint 6.0.7 Cisco Secure Endpoint 6.0.9 Cisco Secure Endpoint 6.1.5 Cisco Secure Endpoint 6.1.7 Cisco Secure Endpoint 6.1.9 Cisco Secure Endpoint 6.2.1 Cisco Secure Endpoint 6.2.3 Cisco Secure Endpoint 6.2.5 Cisco Secure Endpoint 6.2.9 Cisco Secure Endpoint 6.2.19 Cisco Secure Endpoint 6.3.1 Cisco Secure Endpoint 6.3.3 Cisco Secure Endpoint 6.3.5 Cisco Secure Endpoint 6.3.7 Cisco Secure Endpoint 7.0.5 Cisco Secure Endpoint 7.1.1 Cisco Secure Endpoint 7.1.5 Cisco Secure Endpoint 7.2.3 Cisco Secure Endpoint 7.2.5 Cisco Secure Endpoint 7.2.7 Cisco Secure Endpoint 7.2.11 Cisco Secure Endpoint 7.2.13 Cisco Secure Endpoint 7.3.1 Cisco Secure Endpoint 7.3.3 Cisco Secure Endpoint 7.3.5 Cisco Secure Endpoint 7.3.9 Cisco Secure Endpoint 7.5.5 Cisco Secure Endpoint 1.17.2 Cisco Secure Endpoint 1.18.0 Cisco Secure Endpoint 1.18.1 Cisco Secure Endpoint 1.18.2 Cisco Secure Endpoint 1.16.3	137
Application	Clamav Clamav Clamav 1.0.0 Clamav Clamav - Clamav Clamav 0.01 Clamav Clamav 0.02 Clamav Clamav 0.03 Clamav Clamav 0.3 Clamav Clamav 0.05 Clamav Clamav 0.8 Clamav Clamav 0.9 Clamav Clamav 0.10 Clamav Clamav 0.12 Clamav Clamav 0.13 Clamav Clamav 0.14 Clamav Clamav 0.15 Clamav Clamav 0.20 Clamav Clamav 0.21 Clamav Clamav 0.22 Clamav Clamav 0.23 Clamav Clamav 0.24 Clamav Clamav 0.51 Clamav Clamav 0.52 Clamav Clamav 0.53 Clamav Clamav 0.54 Clamav Clamav 0.60 Clamav Clamav 0.60P Clamav Clamav 0.65 Clamav Clamav 0.66 Clamav Clamav 0.67 Clamav Clamav 0.67-1 Clamav Clamav 0.68 Clamav Clamav 0.68.1 Clamav Clamav 0.70 Clamav Clamav 0.70.0 Clamav Clamav 0.71 Clamav Clamav 0.71.0 Clamav Clamav 0.72 Clamav Clamav 0.72.0 Clamav Clamav 0.73 Clamav Clamav 0.73.0 Clamav Clamav 0.74 Clamav Clamav 0.74.0 Clamav Clamav 0.75 Clamav Clamav 0.75.0 Clamav Clamav 0.75.1 Clamav Clamav 0.80 Clamav Clamav 0.80.0 Clamav Clamav 0.80_Rc Clamav Clamav 0.81 Clamav Clamav 0.81.0 Clamav Clamav 0.82 Clamav Clamav 0.82.0 Clamav Clamav 0.83 Clamav Clamav 0.83.0 Clamav Clamav 0.84 Clamav Clamav 0.84.0 Clamav Clamav 0.85 Clamav Clamav 0.85.0 Clamav Clamav 0.85.1 Clamav Clamav 0.86 Clamav Clamav 0.86.0 Clamav Clamav 0.86.1 Clamav Clamav 0.86.2 Clamav Clamav 0.87 Clamav Clamav 0.87.0 Clamav Clamav 0.87.1 Clamav Clamav 0.88 Clamav Clamav 0.88.0 Clamav Clamav 0.88.1 Clamav Clamav 0.88.2 Clamav Clamav 0.88.3 Clamav Clamav 0.88.4 Clamav Clamav 0.88.5 Clamav Clamav 0.88.6 Clamav Clamav 0.88.7 Clamav Clamav 0.88.7_P0 Clamav Clamav 0.88.7_P1 Clamav Clamav 0.90 Clamav Clamav 0.90.0 Clamav Clamav 0.90.1 Clamav Clamav 0.90.1_P0 Clamav Clamav 0.90.2 Clamav Clamav 0.90.2_P0 Clamav Clamav 0.90.3 Clamav Clamav 0.90.3_P0 Clamav Clamav 0.90.3_P1 Clamav Clamav 0.91 Clamav Clamav 0.91.0 Clamav Clamav 0.91.1 Clamav Clamav 0.91.2 Clamav Clamav 0.91.2_P0 Clamav Clamav 0.92 Clamav Clamav 0.92.0 Clamav Clamav 0.92.1 Clamav Clamav 0.92_P0 Clamav Clamav 0.93 Clamav Clamav 0.93.0 Clamav Clamav 0.93.1 Clamav Clamav 0.93.2 Clamav Clamav 0.93.3 Clamav Clamav 0.94 Clamav Clamav 0.94.0 Clamav Clamav 0.94.1 Clamav Clamav 0.94.2 Clamav Clamav 0.95 Clamav Clamav 0.95.0 Clamav Clamav 0.95.1 Clamav Clamav 0.95.2 Clamav Clamav 0.95.3 Clamav Clamav 0.96 Clamav Clamav 0.96.0 Clamav Clamav 0.96.1 Clamav Clamav 0.96.2 Clamav Clamav 0.96.3 Clamav Clamav 0.96.4 Clamav Clamav 0.96.5 Clamav Clamav 0.97 Clamav Clamav 0.97.0 Clamav Clamav 0.97.1 Clamav Clamav 0.97.2 Clamav Clamav 0.97.3 Clamav Clamav 0.97.4 Clamav Clamav 0.97.5 Clamav Clamav 0.97.6 Clamav Clamav 0.97.7 Clamav Clamav 0.97.8 Clamav Clamav 0.98.0 Clamav Clamav 0.98.1 Clamav Clamav 0.98.3 Clamav Clamav 0.98.4 Clamav Clamav 0.98.5 Clamav Clamav 0.98.6 Clamav Clamav 0.98.7 Clamav Clamav 0.99.0 Clamav Clamav 0.99.1 Clamav Clamav 0.99.2 Clamav Clamav 0.99.3 Clamav Clamav 0.99.4 Clamav Clamav 0.100.0 Clamav Clamav 0.100.1 Clamav Clamav 0.100.2 Clamav Clamav 0.101.0 Clamav Clamav 0.101.1 Clamav Clamav 0.101.2 Clamav Clamav 0.101.3 Clamav Clamav 0.101.4 Clamav Clamav 0.101.5 Clamav Clamav 0.102.0 Clamav Clamav 0.102.1 Clamav Clamav 0.102.2 Clamav Clamav 0.102.3 Clamav Clamav 0.102.4 Clamav Clamav 0.103.0 Clamav Clamav 0.103.1 Clamav Clamav 0.103.2 Clamav Clamav 0.103.3 Clamav Clamav 0.103.4 Clamav Clamav 0.103.5 Clamav Clamav 0.103.6 Clamav Clamav 0.103.7 Clamav Clamav 0.104.0 Clamav Clamav 0.104.1 Clamav Clamav 0.104.2 Clamav Clamav 0.104.3 Clamav Clamav 0.105.1	198
Application	Stormshield Stormshield Stormshield Network Security 4.4.0 Stormshield Stormshield Network Security 4.4.1 Stormshield Stormshield Network Security 4.5.1 Stormshield Stormshield Network Security 4.5.2 Stormshield Stormshield Network Security 4.5.3 Stormshield Stormshield Network Security 4.5.4 Stormshield Stormshield Network Security 4.6.0 Stormshield Stormshield Network Security 4.6.1 Stormshield Stormshield Network Security 4.6.2 Stormshield Stormshield Network Security 4.6.3 Stormshield Stormshield Network Security 4.3.0 Stormshield Stormshield Network Security 4.3.3 Stormshield Stormshield Network Security 4.3.4 Stormshield Stormshield Network Security 4.3.5 Stormshield Stormshield Network Security 4.3.6 Stormshield Stormshield Network Security 4.3.7 Stormshield Stormshield Network Security 4.3.8 Stormshield Stormshield Network Security 4.3.9 Stormshield Stormshield Network Security 4.3.10 Stormshield Stormshield Network Security 4.3.11 Stormshield Stormshield Network Security 4.3.12 Stormshield Stormshield Network Security 4.3.12.1 Stormshield Stormshield Network Security 4.3.13 Stormshield Stormshield Network Security 4.3.14 Stormshield Stormshield Network Security 4.3.15 Stormshield Stormshield Network Security 4.3.16 Stormshield Stormshield Network Security 3.8.0 Stormshield Stormshield Network Security 3.8.1 Stormshield Stormshield Network Security 3.9.1 Stormshield Stormshield Network Security 3.10.0 Stormshield Stormshield Network Security 3.11.0 Stormshield Stormshield Network Security 3.11.1 Stormshield Stormshield Network Security 3.11.4 Stormshield Stormshield Network Security 3.11.5 Stormshield Stormshield Network Security 3.11.8 Stormshield Stormshield Network Security 3.11.9 Stormshield Stormshield Network Security 3.11.12 Stormshield Stormshield Network Security 3.11.13 Stormshield Stormshield Network Security 3.11.17 Stormshield Stormshield Network Security 3.11.18 Stormshield Stormshield Network Security 3.11.19 Stormshield Stormshield Network Security 3.11.20 Stormshield Stormshield Network Security 3.11.21 Stormshield Stormshield Network Security 3.11.22 Stormshield Stormshield Network Security 3.0.0 Stormshield Stormshield Network Security 3.0.1 Stormshield Stormshield Network Security 3.0.2 Stormshield Stormshield Network Security 3.0.3 Stormshield Stormshield Network Security 3.1.0 Stormshield Stormshield Network Security 3.1.1 Stormshield Stormshield Network Security 3.1.2 Stormshield Stormshield Network Security 3.2.0 Stormshield Stormshield Network Security 3.2.1 Stormshield Stormshield Network Security 3.3.0 Stormshield Stormshield Network Security 3.3.1 Stormshield Stormshield Network Security 3.3.2 Stormshield Stormshield Network Security 3.4.0 Stormshield Stormshield Network Security 3.4.1 Stormshield Stormshield Network Security 3.4.2 Stormshield Stormshield Network Security 3.4.3 Stormshield Stormshield Network Security 3.5.0 Stormshield Stormshield Network Security 3.5.1 Stormshield Stormshield Network Security 3.5.2 Stormshield Stormshield Network Security 3.6.0 Stormshield Stormshield Network Security 3.6.1 Stormshield Stormshield Network Security 3.7.0 Stormshield Stormshield Network Security 3.7.1 Stormshield Stormshield Network Security 3.7.10 Stormshield Stormshield Network Security 3.7.13 Stormshield Stormshield Network Security 3.7.16 Stormshield Stormshield Network Security 3.7.17 Stormshield Stormshield Network Security 3.7.20 Stormshield Stormshield Network Security 3.7.21 Stormshield Stormshield Network Security 3.7.24 Stormshield Stormshield Network Security 3.7.25 Stormshield Stormshield Network Security 3.7.29 Stormshield Stormshield Network Security 3.7.30 Stormshield Stormshield Network Security 3.7.33 Stormshield Stormshield Network Security 3.7.34	80

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy