On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execu
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow…
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Secure Web Appliance | 11.7.0-406, 11.7.0-418, 11.7.1-049, 11.7.1-006, 11.7.1-020, 11.7.2-011, 11.8.0-414, 11.8.1-023, 11.8.3-018, 11.8.3-021, 12.0.1-268, 12.0.3-007, 12.5.2-007, 12.5.1-011, 12.5.4-005, 12.5.5-004, 14.5.0-498, 14.0.3-014, 14.0.2-012 |
| Cisco | Cisco Secure Endpoint | 6.1.9, 6.2.5, 6.3.7, 6.3.3, 7.0.5, 7.1.1, 1.12.1, 1.12.2, 1.12.3, 1.12.7, 1.12.4, 1.11.0, 1.10.2, 1.10.0, 1.14.0, 1.6.0, 1.9.0, 1.8.1, 1.8.0, 1.7.0, 7.2.13, 7.3.5 |
| Cisco | Cisco Secure Endpoint Private Cloud Administration Portal | N/A |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.