SB20240806106 - Amazon Linux AMI update for clamav

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-20698)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a flaw in the OOXML parsing module. A remote attacker can send a specially crafted OOXML file and perform a denial of service (DoS) attack.

2) Infinite loop (CVE-ID: CVE-2022-20770)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the CHM file parser. A remote attacker can consume all available system resources and cause denial of service conditions.

3) Infinite loop (CVE-ID: CVE-2022-20771)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the TIFF file parser. A remote attacker can consume all available system resources and cause denial of service conditions.

4) Memory leak (CVE-ID: CVE-2022-20785)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when parsing HTML files. A remote attacker can pass specially crafted HTML file to the antivirus software, trigger memory leak and perform denial of service attack.

5) NULL pointer dereference (CVE-ID: CVE-2022-20796)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the scan verdict cache check. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://alas.aws.amazon.com/AL2023/ALAS-2023-052.html