ClamAV gets 4 parser bugs at once, plus a Plesk SQL injection worth watching

An attacker can crash the ClamAV scanning process by sending a specially crafted XAR archive. The bug is a memory corruption issue triggered during XAR file parsing, and Cisco notes it could potentially go beyond a simple crash. No authentication is needed: just get the malicious file in front of a ClamAV scanner, for example through an email gateway or file upload endpoint.

Affected estate

Anyone running ClamAV for mail gateway scanning, file upload inspection, or endpoint protection

How to check

Run 'clamscan --version' or 'clamd --version' and compare against the fixed version listed in Cisco's advisory.

Included because

unauthenticated; remotely triggerable via email or file upload; memory corruption with possible expanded impact

Action

Update ClamAV to the patched version via your package manager or Cisco's download.

Why it matters

A crashed scanner means mail or file uploads go unscanned, creating a gap attackers can walk through.

Source

Cisco Security Advisory

ClamAV's Mach-O file parser has an out-of-bounds read that lets an attacker crash the scanning process with a crafted file. No authentication required. While the primary impact is denial of service, Cisco flags the potential for broader memory corruption consequences. Any path that feeds files into ClamAV is an attack surface here.

Affected estate

Anyone running ClamAV for mail gateway scanning, file upload inspection, or endpoint protection

How to check

Run 'clamscan --version' and compare against the fixed version in Cisco's advisory.

Included because

unauthenticated; remotely triggerable; memory corruption with possible expanded impact

Action

Update ClamAV to the patched version via your package manager or Cisco's download.

Why it matters

A killed scanner process leaves a gap in your antimalware pipeline until the service restarts or is noticed.

Source

Cisco Security Advisory

ClamAV's GPT disk image parser has a bug in an endian conversion operation that can cause an out-of-bounds buffer write. Sending a crafted GPT image to ClamAV crashes the scanner, and the write primitive means code execution may be possible. No authentication needed: just deliver the file via email, upload, or any other scanned channel.

Affected estate

Anyone running ClamAV for mail gateway scanning, file upload inspection, or endpoint protection

How to check

Run 'clamscan --version' and compare against the fixed version listed in Cisco's advisory.

Included because

unauthenticated; remotely triggerable; out-of-bounds write with possible code execution

Action

Update ClamAV to the patched version via your package manager or Cisco's download.

Why it matters

An out-of-bounds write is more dangerous than a simple crash. This could potentially be chained into code execution on your scanning host.

Source

Cisco Security Advisory

ClamAV's PESpin parser has an integer overflow triggered by crafted PESpin-packed content. An attacker can crash the ClamAV process by submitting a malicious file, and memory corruption opens the door to potentially worse outcomes. No authentication is required, so any file intake path is a viable attack vector.

Affected estate

Anyone running ClamAV for mail gateway scanning, file upload inspection, or endpoint protection

How to check

Run 'clamscan --version' and compare against the fixed version in Cisco's advisory.

Included because

unauthenticated; remotely triggerable; integer overflow leading to memory corruption

Action

Update ClamAV to the patched version via your package manager or Cisco's download.

Why it matters

A downed antimalware scanner on your mail gateway or upload service means malicious files pass through unchecked.

Source

Cisco Security Advisory