CVE catalog

CVE-2022-20770

clamav: CVE-2022-20770

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
7.07% · Oct 27, 2026

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianclamavsid1.4.6+dfsg-1fixed
Debianclamavforky1.4.6+dfsg-1fixed
Debianclamavtrixie1.4.3+dfsg-1fixed
Debianclamavbookworm1.4.3+dfsg-1~deb12u2fixed
Debianclamavbookworm-security1.4.6+dfsg-0+deb12u1fixed
Ubuntuclamavpro0.98.7+dfsg-0ubuntu4vulnerable
Ubuntuclamavpro0.98.7+dfsg-0ubuntu5vulnerable
Ubuntuclamavpro0.99+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.99+dfsg-1ubuntu1.1vulnerable
Ubuntuclamavpro0.99+dfsg-1ubuntu1.2vulnerable
Ubuntuclamavpro0.99.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.99.2+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamavpro0.99.2+dfsg-0ubuntu0.16.04.3vulnerable
Ubuntuclamavpro0.99.3+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.99.4+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.100.1+dfsg-1ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.100.1+dfsg-1ubuntu0.16.04.2vulnerable
Ubuntuclamavpro0.100.1+dfsg-1ubuntu0.16.04.3vulnerable
Ubuntuclamavpro0.100.2+dfsg-1ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.100.3+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.101.4+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.102.1+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamavpro0.102.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.102.3+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.102.4+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.16.04.1+esm1vulnerable
Ubuntuclamavpro0.103.5+dfsg-0ubuntu0.16.04.1+esm1vulnerable
Ubuntuclamavpro0.103.6+dfsg-0ubuntu0.16.04.1+esm1fixed
Ubuntuclamavpro0.98.7+dfsg-0ubuntu4vulnerable
Ubuntuclamavpro0.98.7+dfsg-0ubuntu5vulnerable
Ubuntuclamavpro0.99+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.99+dfsg-1ubuntu1.1vulnerable
Ubuntuclamavpro0.99+dfsg-1ubuntu1.2vulnerable
Ubuntuclamavpro0.99.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.99.2+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamavpro0.99.2+dfsg-0ubuntu0.16.04.3vulnerable
Ubuntuclamavpro0.99.3+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.99.4+addedllvm-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.100.1+dfsg-1ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.100.1+dfsg-1ubuntu0.16.04.2vulnerable
Ubuntuclamavpro0.100.1+dfsg-1ubuntu0.16.04.3vulnerable
Ubuntuclamavpro0.100.2+dfsg-1ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.100.3+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.101.4+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.102.1+dfsg-0ubuntu0.16.04.2vulnerable
Ubuntuclamavpro0.102.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.102.3+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.102.4+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.16.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.16.04.1+esm1vulnerable
Ubuntuclamavpro0.103.5+dfsg-0ubuntu0.16.04.1+esm1vulnerable
Ubuntuclamavpro0.103.6+dfsg-0ubuntu0.16.04.1+esm1fixed
Ubuntuclamav18.040.99.2+dfsg-6ubuntu2vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu1vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu2vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu2vulnerable
Ubuntuclamav18.040.99.4+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.2vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.3vulnerable
Ubuntuclamav18.040.100.2+dfsg-1ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.100.3+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.101.4+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.102.1+dfsg-0ubuntu0.18.04.2vulnerable
Ubuntuclamav18.040.102.2+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.102.3+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.102.4+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.103.2+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.103.2+dfsg-0ubuntu0.18.04.2vulnerable
Ubuntuclamav18.040.103.2+dfsg-0ubuntu0.18.04.3vulnerable
Ubuntuclamav18.040.103.5+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.103.6+dfsg-0ubuntu0.18.04.1fixed
Ubuntuclamav20.040.101.4+dfsg-1ubuntu1vulnerable
Ubuntuclamav20.040.102.1+dfsg-1ubuntu1vulnerable
Ubuntuclamav20.040.102.1+dfsg-2ubuntu1vulnerable
Ubuntuclamav20.040.102.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav20.040.102.2+dfsg-1ubuntu1vulnerable
Ubuntuclamav20.040.102.2+dfsg-2ubuntu1vulnerable
Ubuntuclamav20.040.102.3+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamav20.040.102.4+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamav20.040.103.2+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamav20.040.103.2+dfsg-0ubuntu0.20.04.2vulnerable
Ubuntuclamav20.040.103.5+dfsg-1~20.04.1vulnerable
Ubuntuclamav20.040.103.6+dfsg-0ubuntu0.20.04.1fixed
Ubuntuclamav22.040.103.3+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1build1vulnerable
Ubuntuclamav22.040.103.5+dfsg-1vulnerable
Ubuntuclamav22.040.103.6+dfsg-0ubuntu0.22.04.1fixed
Ubuntuclamav18.040.99.2+dfsg-6ubuntu2vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu1vulnerable
Ubuntuclamav18.040.99.3~beta1+dfsg-2ubuntu2vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.99.3+addedllvm-0ubuntu2vulnerable
Ubuntuclamav18.040.99.4+addedllvm-0ubuntu1vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.2vulnerable
Ubuntuclamav18.040.100.1+dfsg-1ubuntu0.18.04.3vulnerable
Ubuntuclamav18.040.100.2+dfsg-1ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.100.3+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.101.4+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.102.1+dfsg-0ubuntu0.18.04.2vulnerable
Ubuntuclamav18.040.102.2+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.102.3+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.102.4+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.103.2+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.103.2+dfsg-0ubuntu0.18.04.2vulnerable
Ubuntuclamav18.040.103.2+dfsg-0ubuntu0.18.04.3vulnerable
Ubuntuclamav18.040.103.5+dfsg-0ubuntu0.18.04.1vulnerable
Ubuntuclamav18.040.103.6+dfsg-0ubuntu0.18.04.1fixed
Ubuntuclamav20.040.101.4+dfsg-1ubuntu1vulnerable
Ubuntuclamav20.040.102.1+dfsg-1ubuntu1vulnerable
Ubuntuclamav20.040.102.1+dfsg-2ubuntu1vulnerable
Ubuntuclamav20.040.102.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav20.040.102.2+dfsg-1ubuntu1vulnerable
Ubuntuclamav20.040.102.2+dfsg-2ubuntu1vulnerable
Ubuntuclamav20.040.102.3+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamav20.040.102.4+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamav20.040.103.2+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamav20.040.103.2+dfsg-0ubuntu0.20.04.2vulnerable
Ubuntuclamav20.040.103.5+dfsg-1~20.04.1vulnerable
Ubuntuclamav20.040.103.6+dfsg-0ubuntu0.20.04.1fixed
Ubuntuclamav22.040.103.3+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1build1vulnerable
Ubuntuclamav22.040.103.5+dfsg-1vulnerable
Ubuntuclamav22.040.103.6+dfsg-0ubuntu0.22.04.1fixed
Opensuseclamavtumbleweed0.103.6-1.1fixed
Suseclamavlinux enterprise module for basesystem 15 sp30.103.6-150000.3.38.1fixed
Suseclamavlinux enterprise module for basesystem 15 sp40.103.6-150000.3.38.1fixed
Opensuseclamavleap 15.30.103.6-150000.3.38.1fixed
Opensuseclamavleap 15.40.103.6-150000.3.38.1fixed
Suseclamavlinux enterprise server 12 sp50.103.6-3.18.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp50.103.6-3.18.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianclamavsourcesid0.103.6+dfsg-1not yet assignedNot reportedNot reported
Debianclamavsourceforky0.103.6+dfsg-1not yet assignedNot reportedNot reported
Debianclamavsourcetrixie0.103.6+dfsg-1not yet assignedNot reportedNot reported
Debianclamavsourcebookworm0.103.6+dfsg-1not yet assignedNot reportedNot reported
Ubuntuclamavdebpro0.103.6+dfsg-0ubuntu0.16.04.1+esm1Not reportedUSN-5423-2Not reported
Ubuntuclamavdebpro0.103.6+dfsg-0ubuntu0.16.04.1+esm1Not reportedUBUNTU-CVE-2022-20770Not reported
Ubuntuclamavdeb18.040.103.6+dfsg-0ubuntu0.18.04.1Not reportedUBUNTU-CVE-2022-20770Not reported
Ubuntuclamavdeb20.040.103.6+dfsg-0ubuntu0.20.04.1Not reportedUBUNTU-CVE-2022-20770Not reported
Ubuntuclamavdeb22.040.103.6+dfsg-0ubuntu0.22.04.1Not reportedUBUNTU-CVE-2022-20770Not reported
Ubuntuclamavdeb18.040.103.6+dfsg-0ubuntu0.18.04.1Not reportedUSN-5423-1Not reported
Ubuntuclamavdeb20.040.103.6+dfsg-0ubuntu0.20.04.1Not reportedUSN-5423-1Not reported
Ubuntuclamavdeb22.040.103.6+dfsg-0ubuntu0.22.04.1Not reportedUSN-5423-1Not reported
Opensuseclamavrpmtumbleweed0.103.6-1.1Not reportedOPENSUSE-SU-2024:12047-1Not reported
Suseclamavrpmlinux enterprise module for basesystem 15 sp30.103.6-150000.3.38.1Not reportedSUSE-SU-2022:1644-1Not reported
Suseclamavrpmlinux enterprise module for basesystem 15 sp40.103.6-150000.3.38.1Not reportedSUSE-SU-2022:1644-1Not reported
Opensuseclamavrpmleap 15.30.103.6-150000.3.38.1Not reportedSUSE-SU-2022:1644-1Not reported
Opensuseclamavrpmleap 15.40.103.6-150000.3.38.1Not reportedSUSE-SU-2022:1644-1Not reported
Suseclamavrpmlinux enterprise server 12 sp50.103.6-3.18.1Not reportedSUSE-SU-2022:1647-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp50.103.6-3.18.1Not reportedSUSE-SU-2022:1647-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [clamav-devel]Unknown

    Source package: [clamav]

    Details (1)

    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.103.6-1.1

      Version impact unknown

      dsa · clamav · opensuse · tumbleweed

  • [clamav-docs-html]Unknown

    Source package: [clamav]

    Details (1)

    • 1.5.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.103.6-1.1

      Version impact unknown

      dsa · clamav · opensuse · tumbleweed

  • [clamav-milter]Unknown

    Source package: [clamav]

    Details (1)

    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.103.6-1.1

      Version impact unknown

      dsa · clamav · opensuse · tumbleweed

  • [libclamav12]Unknown

    Source package: [clamav]

    Details (1)

    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.103.6-1.1

      Version impact unknown

      dsa · clamav · opensuse · tumbleweed

  • [libclammspack0]Unknown

    Source package: [clamav]

    Details (1)

    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.103.6-1.1

      Version impact unknown

      dsa · clamav · opensuse · tumbleweed

  • [libfreshclam4]Unknown

    Source package: [clamav]

    Details (1)

    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.103.6-1.1

      Version impact unknown

      dsa · clamav · opensuse · tumbleweed

  • [clamav]Fixed

    Source package: [clamav]

    Details (1)

    • 1.5.4-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.103.6-1.1

      dsa · clamav · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [clamav]Fixed
    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamav-base]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamav-daemon]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamav-doc]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamav-docs]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamav-freshclam]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamav-milter]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamav-testfiles]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [clamdscan]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [libclamav12]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

  • [libclamav-dev]Fixed

    Source package: [clamav]

    Details (2)

    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.103.6+dfsg-1

      dsa · clamav · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]