Show plain JSON{"containers": {"cna": {"affected": [{"product": "ClamAV", "vendor": "Cisco", "versions": [{"lessThan": "0.102.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Special thanks to Daehui Chang and Fady Othman for helping identify the ARJ parsing vulnerability."}], "datePublic": "2020-05-12T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-06T07:06:04", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html"}, {"name": "[debian-lts-announce] 20200519 [SECURITY] [DLA 2215-1] clamav security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00018.html"}, {"name": "FEDORA-2020-bca44487a1", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5YWYT27SBTV4RZSGFHIQUI4LQVFASWS/"}, {"name": "FEDORA-2020-d98d2cbae1", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROBJOGJOT44MVDX7RQEACYHQN4LYW5RK/"}, {"name": "FEDORA-2020-b0acd7b66e", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BMTC7I5LGY4FCIZLHPNC4WWC6VNLFER/"}, {"name": "USN-4370-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4370-1/"}, {"name": "USN-4370-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4370-2/"}, {"name": "GLSA-202007-23", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/202007-23"}, {"name": "USN-4435-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4435-1/"}, {"name": "FEDORA-2020-dd0c20d985", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QM7EXJHDEZJLWM2NKH6TCDXOBP5NNYIN/"}, {"name": "USN-4435-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4435-2/"}, {"name": "FEDORA-2020-6584a641ae", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ67VH37NCG25PICGWFWZHSVG7PBT7MC/"}, {"name": "[debian-lts-announce] 20200806 [SECURITY] [DLA 2314-1] clamav security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00010.html"}], "source": {"advisory": "clamav-01023-security-patch", "defect": ["clamav-01023-security-patch"], "discovery": "EXTERNAL"}, "title": "ClamAV ARJ Archive Parsing Denial of Service Vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2020-05-12T16:00:00.000Z", "ID": "CVE-2020-3327", "STATE": "PUBLIC", "TITLE": "ClamAV ARJ Archive Parsing Denial of Service Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ClamAV", "version": {"version_data": [{"version_affected": "<", "version_value": "0.102.3"}]}}]}, "vendor_name": "Cisco"}]}}, "credit": [{"lang": "eng", "value": "Special thanks to Daehui Chang and Fady Othman for helping identify the ARJ parsing vulnerability."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20 Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html", "refsource": "CISCO", "url": "https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html"}, {"name": "[debian-lts-announce] 20200519 [SECURITY] [DLA 2215-1] clamav security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00018.html"}, {"name": "FEDORA-2020-bca44487a1", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5YWYT27SBTV4RZSGFHIQUI4LQVFASWS/"}, {"name": "FEDORA-2020-d98d2cbae1", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBJOGJOT44MVDX7RQEACYHQN4LYW5RK/"}, {"name": "FEDORA-2020-b0acd7b66e", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3BMTC7I5LGY4FCIZLHPNC4WWC6VNLFER/"}, {"name": "USN-4370-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4370-1/"}, {"name": "USN-4370-2", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4370-2/"}, {"name": "GLSA-202007-23", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202007-23"}, {"name": "USN-4435-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4435-1/"}, {"name": "FEDORA-2020-dd0c20d985", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QM7EXJHDEZJLWM2NKH6TCDXOBP5NNYIN/"}, {"name": "USN-4435-2", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4435-2/"}, {"name": "FEDORA-2020-6584a641ae", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ67VH37NCG25PICGWFWZHSVG7PBT7MC/"}, {"name": "[debian-lts-announce] 20200806 [SECURITY] [DLA 2314-1] clamav security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00010.html"}]}, "source": {"advisory": "clamav-01023-security-patch", "defect": ["clamav-01023-security-patch"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T07:30:58.038Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html"}, {"name": "[debian-lts-announce] 20200519 [SECURITY] [DLA 2215-1] clamav security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00018.html"}, {"name": "FEDORA-2020-bca44487a1", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5YWYT27SBTV4RZSGFHIQUI4LQVFASWS/"}, {"name": "FEDORA-2020-d98d2cbae1", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROBJOGJOT44MVDX7RQEACYHQN4LYW5RK/"}, {"name": "FEDORA-2020-b0acd7b66e", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BMTC7I5LGY4FCIZLHPNC4WWC6VNLFER/"}, {"name": "USN-4370-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4370-1/"}, {"name": "USN-4370-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4370-2/"}, {"name": "GLSA-202007-23", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/202007-23"}, {"name": "USN-4435-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4435-1/"}, {"name": "FEDORA-2020-dd0c20d985", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QM7EXJHDEZJLWM2NKH6TCDXOBP5NNYIN/"}, {"name": "USN-4435-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4435-2/"}, {"name": "FEDORA-2020-6584a641ae", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ67VH37NCG25PICGWFWZHSVG7PBT7MC/"}, {"name": "[debian-lts-announce] 20200806 [SECURITY] [DLA 2314-1] clamav security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00010.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-15T16:21:23.316854Z", "id": "CVE-2020-3327", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T17:22:05.241Z"}}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2020-3327", "datePublished": "2020-05-13T02:20:13.063319Z", "dateReserved": "2019-12-12T00:00:00", "dateUpdated": "2024-11-15T17:22:05.241Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"} 
MITRE
Vulnrichment
NVD
Redhat