CVE-2023-20052

Name	CVE-2023-20052
Description	On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3328-1, ELA-801-1
Debian Bugs	1031509

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clamav (PTS)	jessie, jessie (lts)	0.103.12+dfsg-0+deb8u1	fixed
	stretch (security)	0.103.6+dfsg-0+deb9u1	vulnerable
	stretch (lts), stretch	0.103.12+dfsg-0+deb9u1	fixed
	buster, buster (lts)	1.0.7+dfsg-1~deb10u1	fixed
	buster (security)	0.103.9+dfsg-0+deb10u1	fixed
	bullseye	0.103.10+dfsg-0+deb11u1	fixed
	bullseye (security)	1.0.7+dfsg-1~deb11u2	fixed
	bookworm	1.0.7+dfsg-1~deb12u1	fixed
	sid, trixie	1.4.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
clamav	source	jessie	0.103.8+dfsg-0+deb8u1	ELA-801-1
clamav	source	stretch	0.103.8+dfsg-0+deb9u1	ELA-801-1
clamav	source	buster	0.103.8+dfsg-0+deb10u1	DLA-3328-1
clamav	source	bullseye	0.103.8+dfsg-0+deb11u1
clamav	source	(unstable)	1.0.1+dfsg-1		1031509

https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html