CVE-2020-3481

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Cisco	ClamAV	>= unspecified, < 0.102.4

References

https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00010.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ67VH37NCG25PICGWFWZHSVG7PBT7MC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QM7EXJHDEZJLWM2NKH6TCDXOBP5NNYIN/
https://security.gentoo.org/glsa/202007-23Third Party Advisory
https://usn.ubuntu.com/4435-1/Third Party Advisory
https://usn.ubuntu.com/4435-2/Third Party Advisory
https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00010.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ67VH37NCG25PICGWFWZHSVG7PBT7MC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QM7EXJHDEZJLWM2NKH6TCDXOBP5NNYIN/
https://security.gentoo.org/glsa/202007-23Third Party Advisory
https://usn.ubuntu.com/4435-1/Third Party Advisory
https://usn.ubuntu.com/4435-2/Third Party Advisory

Timeline

Published: Jul 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-34826.5A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated CVE-2020-34836.3Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and privat CVE-2020-34845.3A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attack CVE-2020-34856.3A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Directo CVE-2020-34866.5Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for CVE-2020-34876.5Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for CVE-2020-34887.4Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for CVE-2020-34897.4Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for CVE-2020-34904.9A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker CVE-2020-34914.8A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker CVE-2020-34928.6A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controll CVE-2020-34937.4Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for