CVE-2023-20032

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:<br /> <br /> <br /> A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.<br /> <br /> <br /> This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.<br /> <br /> For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"].