Detections
Analytics

Alpine: multiple clamav packages, multiple freshclam packages: security update to 1.2.2-r0

high Tenable Cloud Security Plugin ID 425977

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker
 to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an
 incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An
 attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be
 scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV
 scanning process to terminate, resulting in a DoS condition on the affected software and consuming
 available system resources. For a description of this vulnerability, see the ClamAV blog .
 (CVE-2024-20290)

 - A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary
 commands with the privileges of the application service account.The vulnerability is due to unsafe
 handling of file names. A local attacker could exploit this vulnerability by supplying a file name
 containing command-line sequences. When processed on a system using configuration options for the
 VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has
 released software updates that address this vulnerability. There are no workarounds that address this
 vulnerability. (CVE-2024-20328)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-20290

https://security.alpinelinux.org/vuln/CVE-2024-20328

Plugin Details

Severity: High

ID: 425977

Version: Revision 1.8

Type: Local

Published: 5/16/2025

Updated: 12/22/2025

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-20290

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2/7/2024

Reference Information

CVE: CVE-2024-20290, CVE-2024-20328

IAVB: 2024-B-0008-S