ClamAV Universal Disk Format Processing Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in ClamAV's handling of Universal Disk Format (UDF) files. This issue allows an unauthenticated, remote attacker to cause a memory overread during UDF file scanning, which can crash the ClamAV scanning process. The vulnerability affects ClamAV versions 1.2.0 prior to 1.4.3 and 1.0.8 prior to 1.0.9.

Impact

Exploitation of this vulnerability leads to a crash of the ClamAV scanning process, causing a denial-of-service condition on the affected software.

Remediation

Users can upgrade to ClamAV versions 1.4.3 or 1.0.9, both of which include the necessary fix. The release files for these versions are available on the ClamAV downloads page, the GitHub Release page, and through Docker Hub.