SB2022080604 - Amazon Linux AMI update for clamav
Published: August 6, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2022-20770)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the CHM file parser. A remote attacker can consume all available system resources and cause denial of service conditions.
2) Infinite loop (CVE-ID: CVE-2022-20771)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the TIFF file parser. A remote attacker can consume all available system resources and cause denial of service conditions.
3) Memory leak (CVE-ID: CVE-2022-20785)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak when parsing HTML files. A remote attacker can pass specially crafted HTML file to the antivirus software, trigger memory leak and perform denial of service attack.
4) NULL pointer dereference (CVE-ID: CVE-2022-20796)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the scan verdict cache check. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.