Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-20197: ClamAV HFS+ scan can freeze the system
CVE-2023-20197 · published 3 years ago
Summary
ClamAV's module for reading HFS+ disk images can get stuck when a specially crafted image is scanned, causing the scanner to stop responding and potentially consuming all system resources. This affects ClamAV installations on Debian, Cisco Secure Endpoint (including Private Cloud), and Fedora. Update ClamAV to the latest patched version or disable HFS+ image scanning until the fix is applied.
What to do
- Update debian clamav to version 1.0.2+dfsg-1~deb12u1.
- Update debian clamav to version 1.0.2+dfsg-1.
- Update cisco secure_endpoint_private_cloud to version 3.8.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | clamav |
< 1.0.2+dfsg-1~deb12u1 Fix: upgrade to 1.0.2+dfsg-1~deb12u1
|
| Debian:13 | debian | clamav |
< 1.0.2+dfsg-1 Fix: upgrade to 1.0.2+dfsg-1
|
| Debian:14 | debian | clamav |
< 1.0.2+dfsg-1 Fix: upgrade to 1.0.2+dfsg-1
|
| – | cisco | secure_endpoint |
< 1.22.0 < 7.5.13.21586 >= 8.0.1.21160, < 8.1.7.21585 cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:* |
| – | cisco | secure_endpoint_private_cloud |
< 3.8.0 cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
38 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
Original advisory text
A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an ...
A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources.
For a description of this vulnerability, see the ClamAV blog .
This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources.
For a description of this vulnerability, see the ClamAV blog .
References
Severity
7.5
High
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published16 Aug 2023
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta