Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-20506

Fixed in a distro release EPSS <1%CVSS 6.1

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

Published 2024-09-04 · CVE record · OSV

Products: Cisco ClamAV

Distro releases

ReleasePackageFixed in
Chainguardclamav1.4.1-r0
Chainguardclamav-1.31.3.2-r0
Chainguardclamav-1.3-clamdscan1.3.2-r0
Chainguardclamav-1.3-daemon1.3.2-r0
Chainguardclamav-1.3-db1.3.2-r0
Chainguardclamav-1.3-dev1.3.2-r0
Chainguardclamav-1.3-doc1.3.2-r0
Chainguardclamav-1.3-freshclam1.3.2-r0
Chainguardclamav-1.3-libunrar1.3.2-r0
Chainguardclamav-1.3-milter1.3.2-r0
Chainguardclamav-1.3-scanner1.3.2-r0
Chainguardclamav-1.41.4.1-r0
Chainguardclamav-1.4-clamdscan1.4.1-r0
Chainguardclamav-1.4-daemon1.4.1-r0
Chainguardclamav-1.4-db1.4.1-r0
Chainguardclamav-1.4-dev1.4.1-r0
Chainguardclamav-1.4-doc1.4.1-r0
Chainguardclamav-1.4-docker1.4.1-r0
Chainguardclamav-1.4-freshclam1.4.1-r0
Chainguardclamav-1.4-libunrar1.4.1-r0
Chainguardclamav-1.4-milter1.4.1-r0
Chainguardclamav-1.4-scanner1.4.1-r0
Chainguardclamav-clamdscan1.4.1-r0
Chainguardclamav-daemon1.4.1-r0
Chainguardclamav-db1.4.1-r0
Chainguardclamav-dev1.4.1-r0
Chainguardclamav-doc1.4.1-r0
Chainguardclamav-libunrar1.4.1-r0
Chainguardclamav-milter1.4.1-r0
Chainguardclamav-scanner1.4.1-r0
Chainguardfreshclam1.4.1-r0
Debian 11clamav1.0.7+dfsg-1~deb11u1
Debian 12clamav1.0.7+dfsg-1~deb12u1
Debian 13clamav1.4.1+dfsg-1
Debian 14clamav1.4.1+dfsg-1
SUSE Enterprise Storage 7.1clamav1.4.2-150200.8.3.1
SUSE Enterprise Storage 7.1clamav0.103.12-150000.3.53.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSclamav0.103.12-150000.3.53.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSclamav0.103.12-150000.3.53.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSclamav0.103.12-150000.3.53.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSclamav0.103.12-150000.3.53.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise Micro 5.5clamav1.4.2-150200.8.3.1
SUSE Linux Enterprise Module for Basesystem 15 SP5clamav0.103.12-150000.3.53.1
SUSE Linux Enterprise Module for Basesystem 15 SP6clamav0.103.12-150600.18.3.1
SUSE Linux Enterprise Module for Basesystem 15 SP6clamav1.4.2-150600.18.6.1
SUSE Linux Enterprise Server 12 SP5clamav0.103.12-3.33.1
SUSE Linux Enterprise Server 12 SP5-LTSSclamav1.4.2-3.36.1
SUSE Linux Enterprise Server 15 SP2-LTSSclamav0.103.12-150000.3.53.1
SUSE Linux Enterprise Server 15 SP3-LTSSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise Server 15 SP3-LTSSclamav0.103.12-150000.3.53.1
SUSE Linux Enterprise Server 15 SP4-LTSSclamav0.103.12-150000.3.53.1
SUSE Linux Enterprise Server 15 SP4-LTSSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise Server 15 SP5-LTSSclamav1.4.2-150200.8.3.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5clamav1.4.2-3.36.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5clamav0.103.12-3.33.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2clamav0.103.12-150000.3.53.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3clamav1.4.2-150200.8.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3clamav0.103.12-150000.3.53.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4clamav1.4.2-150200.8.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4clamav0.103.12-150000.3.53.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5clamav1.4.2-150200.8.3.1
SUSE Manager Proxy 4.3clamav1.4.2-150200.8.3.1
SUSE Manager Proxy 4.3clamav0.103.12-150000.3.53.1
SUSE Manager Server 4.3clamav1.4.2-150200.8.3.1
SUSE Manager Server 4.3clamav0.103.12-150000.3.53.1
Ubuntu 20.04 LTSclamav0.103.12+dfsg-0ubuntu0.20.04.1
Ubuntu 22.04 LTSclamav0.103.12+dfsg-0ubuntu0.22.04.1
Ubuntu 24.04 LTSclamav1.0.7+dfsg-0ubuntu0.24.04.1
Ubuntu Pro 14.04 LTSclamavno fix
Ubuntu Pro 16.04 LTSclamav0.103.12+dfsg-0ubuntu0.16.04.1+esm1
Ubuntu Pro 18.04 LTSclamav0.103.12+dfsg-0ubuntu0.18.04.1+esm1
Wolficlamav1.4.1-r0
Wolficlamav-1.31.3.2-r0
Wolficlamav-1.3-clamdscan1.3.2-r0
Wolficlamav-1.3-daemon1.3.2-r0
Wolficlamav-1.3-db1.3.2-r0
Wolficlamav-1.3-dev1.3.2-r0
Wolficlamav-1.3-doc1.3.2-r0
Wolficlamav-1.3-freshclam1.3.2-r0
Wolficlamav-1.3-libunrar1.3.2-r0
Wolficlamav-1.3-milter1.3.2-r0
Wolficlamav-1.3-scanner1.3.2-r0
Wolficlamav-1.41.4.1-r0
Wolficlamav-1.4-clamdscan1.4.1-r0
Wolficlamav-1.4-daemon1.4.1-r0
Wolficlamav-1.4-db1.4.1-r0
Wolficlamav-1.4-dev1.4.1-r0
Wolficlamav-1.4-doc1.4.1-r0
Wolficlamav-1.4-docker1.4.1-r0
Wolficlamav-1.4-freshclam1.4.1-r0
Wolficlamav-1.4-libunrar1.4.1-r0
Wolficlamav-1.4-milter1.4.1-r0
Wolficlamav-1.4-scanner1.4.1-r0
Wolficlamav-clamdscan1.4.1-r0
Wolficlamav-daemon1.4.1-r0
Wolficlamav-db1.4.1-r0
Wolficlamav-dev1.4.1-r0
Wolficlamav-doc1.4.1-r0
Wolficlamav-libunrar1.4.1-r0
Wolficlamav-milter1.4.1-r0
Wolficlamav-scanner1.4.1-r0
Wolfifreshclam1.4.1-r0
openSUSE Leap 15.5clamav0.103.12-150000.3.53.1
openSUSE Leap 15.6clamav1.4.2-150600.18.6.1
openSUSE Leap 15.6clamav0.103.12-150600.18.3.1
openSUSE Tumbleweedclamav1.4.1-1.1