CVE-2020-3350

Name	CVE-2020-3350
Description	A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2314-1, ELA-286-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clamav (PTS)	jessie, jessie (lts)	0.103.9+dfsg-0+deb8u1	fixed
	stretch (security)	0.103.6+dfsg-0+deb9u1	fixed
	stretch (lts), stretch	0.103.9+dfsg-0+deb9u1	fixed
	buster	0.103.6+dfsg-0+deb10u1	fixed
	buster (security)	0.103.9+dfsg-0+deb10u1	fixed
	bullseye	0.103.10+dfsg-0+deb11u1	fixed
	bookworm	1.0.3+dfsg-1~deb12u1	fixed
	trixie	1.0.5+dfsg-1	fixed
	sid	1.0.5+dfsg-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
clamav	source	jessie	0.102.4+dfsg-0+deb8u1	ELA-286-1
clamav	source	stretch	0.102.4+dfsg-0+deb9u1	DLA-2314-1
clamav	source	buster	0.102.4+dfsg-0+deb10u1
clamav	source	(unstable)	0.102.4+dfsg-1

https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html