Read the docs
TI-2020-02880 Aliases CVE-2020-3327GHSA-jgg8-q968-j8hx

ClamAV ARJ Archive Parsing Denial of Service Vulnerability

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05063 92nd percentileScored 2026-11-07
Fix Fixed ClamAV (Cisco): 0.102.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoClamAVbefore 0.102.30.102.3Patch availableCNA
  • ClamAV VendorCisco Affected before 0.102.3 Fixed in 0.102.3 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:cisco:clam_antivirus:*:*:*:*:*:*:*:*up to 0.102.2VulnerableCisco
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
  • cpe:2.3:a:cisco:clam_antivirus:*:*:*:*:*:*:*:* Versions up to 0.102.2 Vulnerable ·Cisco
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*19.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical

Remediation

  • Fix · CNA ClamAV (Cisco) Fixed in 0.102.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Cisco ClamAV — blog.clamav.net/2020/05/clamav-01023-security-patch-release…

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2020-02893 ClamAV PDF Parsing Denial of Service VulnerabilityPriority MEDIUM 45
    Show all 2 records → Advisory →
  • Advisory ·

    Cisco ClamAV — FEDORA-2020-b0acd7b66e

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2020-02893 ClamAV PDF Parsing Denial of Service VulnerabilityPriority MEDIUM 45
    Show all 2 records → Advisory →
Show 4 more groups
  • Advisory ·

    Cisco ClamAV — FEDORA-2020-bca44487a1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2020-02893 ClamAV PDF Parsing Denial of Service VulnerabilityPriority MEDIUM 45
    Show all 2 records → Advisory →
  • Advisory ·

    Cisco ClamAV — FEDORA-2020-d98d2cbae1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2020-02893 ClamAV PDF Parsing Denial of Service VulnerabilityPriority MEDIUM 45
    Show all 2 records → Advisory →
  • Advisory ·

    Cisco ClamAV — USN-4370-1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2020-02893 ClamAV PDF Parsing Denial of Service VulnerabilityPriority MEDIUM 45
    Show all 2 records → Advisory →
  • Advisory ·

    Cisco ClamAV — USN-4370-2

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2020-02893 ClamAV PDF Parsing Denial of Service VulnerabilityPriority MEDIUM 45
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-3327
  2. 2026-10-03 Alias added: GHSA-jgg8-q968-j8hx

References

Advisory 13

  • TI-2020-02893 ClamAV PDF Parsing Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2020-02902 Cisco AMP for Endpoints and ClamAV Privilege Escalation Vulnerability CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences