CVE-2023-20032
published 2023-03-01CVE-2023-20032: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions…
PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
29.31%
98.0th percentile
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:
A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.
This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.
For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"].
Affected
71 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint_private_cloud_administration_portal | — | — |
| cisco | cisco_secure_web_appliance | — | — |
| cisco | cisco_secure_web_appliance | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is triggered by submitting a crafted HFS+ partition file to be scanned by ClamAV; detection should focus on scanning of HFS+ partition files that result in heap buffer overflow conditions in the ClamAV process. ↗
- →Monitor the ClamAV scanning process for unexpected crashes (DoS) or privilege escalation, particularly on Windows where ClamAV runs in a privileged security context (Cisco Secure Endpoint Connector for Windows is critically impacted). ↗
- →The root cause is a missing buffer size check in the HFS+ partition file parser leading to a heap buffer overflow write; look for anomalous memory writes in the ClamAV process when processing HFS+ images. ↗
- →Researcher Simon Scannell discovered this issue in ClamAV's HFS+ file parsing; threat hunting should focus on ClamAV instances processing HFS+ partition files from remote/unauthenticated sources. ↗
- ·Affected ClamAV versions are 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier; fixed versions include 1.0.1 and 0.103.8. Ensure ClamAV is updated beyond these thresholds. ↗
- ·Cisco Secure Endpoint Private Cloud itself is not impacted, but the Secure Endpoint Connector software distributed from the device is impacted; patch the connector software accordingly. ↗
- ·On Linux and Mac platforms, the SIR is rated Medium (not Critical) because ClamAV runs in a lower-privileged context; prioritize patching Windows-based deployments first. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_cisco9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-20032: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV
osv·2023-03-01·CVSS 9.8
CVE-2023-20032 [CRITICAL] CVE-2023-20032: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV bl
OSV
clamav vulnerabilities
osv·2023-02-27·CVSS 9.8
CVE-2023-20032 [CRITICAL] clamav vulnerabilities
clamav vulnerabilities
Simon Scannell discovered that ClamAV incorrectly handled parsing
HFS+ files. A remote attacker could possibly use this issue
to cause ClamAV to crash, resulting in a denial of service,
or execute arbitrary code. (CVE-2023-20032)
Simon Scannell discovered that ClamAV incorrectly handled parsing
DMG files. A remote attacker could possibly use this issue
to expose sensitive information. (CVE-2023-20052)
CISA ICS
ABB M2M Gateway
cisa_ics·2025-04-15
ABB M2M Gateway
ICS Advisory
##
ABB M2M Gateway
Release DateApril 15, 2025
Alert CodeICSA-25-105-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: ABB
- Equipment: M2M Gateway
- Vulnerabilities: Integer Overflow or Wraparound, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Unquoted Search Path or Element, Untrusted Search Path, Use After Free, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Missing Release of Memory after Effective Lifetime, Allocation of Resources Without Limits or Throttling, Improper Privilege Management, Improper Limitati
Ubuntu
ClamAV vulnerabilities
vendor_ubuntu·2023-02-27·CVSS 9.8
CVE-2023-20032 [CRITICAL] ClamAV vulnerabilities
Title: ClamAV vulnerabilities
Summary: Several security issues were fixed in ClamAV.
Simon Scannell discovered that ClamAV incorrectly handled parsing
HFS+ files. A remote attacker could possibly use this issue
to cause ClamAV to crash, resulting in a denial of service,
or execute arbitrary code. (CVE-2023-20032)
Simon Scannell discovered that ClamAV incorrectly handled parsing
DMG files. A remote attacker could possibly use this issue
to expose sensitive information. (CVE-2023-20052)
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Cisco
ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023
vendor_cisco·2023-02-15·CVSS 9.8
CVE-2023-20032 [CRITICAL] CWE-120 ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023
ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:
A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.
This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, res
Microsoft
On Feb 15 2023 the following vulnerability in the ClamAV scanning library was disclosed:
A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier 0.105.1 and earlier
vendor_msrc·2023-02-14·CVSS 9.8
CVE-2023-20032 [CRITICAL] CWE-787 On Feb 15 2023 the following vulnerability in the ClamAV scanning library was disclosed:
A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier 0.105.1 and earlier
On Feb 15 2023 the following vulnerability in the ClamAV scanning library was disclosed:
A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier 0.105.1 and earlier and 0.103.7 and earlier could allow an unauthenticated remote attacker to execute arbitrary code.
This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process or else crash the process resulting in a denial of service (DoS) condition.
For a description of this vulnerability see the ClamAV bl
Debian
CVE-2023-20032: clamav - On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was ...
vendor_debian·2023·CVSS 9.8
CVE-2023-20032 [CRITICAL] CVE-2023-20032: clamav - On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was ...
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV bl
Cisco
ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023
vendor_cisco·CVSS 3.1
CVE-2023-20032 ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023
CVE-2023-20032: ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-03-01
Published