Heap-use-after-free vulnerability in ClamAV
Summary
OSV-2023-650: Heap-use-after-free in yr_parser_lookup_loop_variable. Affects clamav versions >= 0037f5825b0b17a789c7eb29c9cb9a2d39c452bc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed for detecting malicious software. It provides a command-line scanner, a database updater, and integration with various mail servers. The vulnerability affects ClamAV versions prior to commit 0037f5825b0b17a789c7eb29c9cb9a2d39c452bc.
Vulnerability Detail
The vulnerability, identified as OSV-2023-650, is a heap-use-after-free issue in the yr_parser_lookup_loop_variable function of ClamAV. This vulnerability can be triggered during the parsing of YARA rules files. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The heap-use-after-free vulnerability in ClamAV can be exploited to execute arbitrary code or cause a denial-of-service condition. It is crucial to update ClamAV to a patched version that includes the fix commit 0037f5825b0b17a789c7eb29c9cb9a2d39c452bc to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clamav →
FAQ
ClamAV is an open-source antivirus engine used for detecting malicious software.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes, memory corruption, and potentially allow attackers to execute arbitrary code.
An attacker can exploit this vulnerability by crafting a malicious YARA rules file and tricking a user or system into scanning it with a vulnerable version of ClamAV. This can lead to arbitrary code execution or denial-of-service attacks.
Yes, a fix for this vulnerability is available in ClamAV versions that include commit 0037f5825b0b17a789c7eb29c9cb9a2d39c452bc. Users are advised to update their ClamAV installations to a patched version.
No, there are no known workarounds for this vulnerability at this time.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
