CVE-2023-20197

Name	CVE-2023-20197
Description	A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3544-1, ELA-937-1
Debian Bugs	1050057

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clamav (PTS)	jessie, jessie (lts)	0.103.9+dfsg-0+deb8u1	fixed
	stretch (security)	0.103.6+dfsg-0+deb9u1	vulnerable
	stretch (lts), stretch	0.103.9+dfsg-0+deb9u1	fixed
	buster (security), buster, buster (lts)	0.103.9+dfsg-0+deb10u1	fixed
	bullseye	0.103.10+dfsg-0+deb11u1	fixed
	bookworm	1.0.7+dfsg-1~deb12u1	fixed
	sid, trixie	1.4.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
clamav	source	jessie	0.103.9+dfsg-0+deb8u1	ELA-937-1
clamav	source	stretch	0.103.9+dfsg-0+deb9u1	ELA-937-1
clamav	source	buster	0.103.9+dfsg-0+deb10u1	DLA-3544-1
clamav	source	bullseye	0.103.9+dfsg-0+deb11u1
clamav	source	bookworm	1.0.2+dfsg-1~deb12u1
clamav	source	(unstable)	1.0.2+dfsg-1		1050057

https://blog.clamav.net/2023/07/2023-08-16-releases.html