BSD Portsclamav -- Possbile denial-of-service vulnerability
· CVE-2025-20128 · VuXML entry
The ClamAV project reports: A possible buffer overflow read bug is found in the OLE2 file parser that could cause a denial-of-service (DoS) condition.
Affected versions
- clamav >= 1.0.0,1 < 1.4.2,1
- clamav-lts >= 1.0.0,1 < 1.0.8,1
By system
0 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/clamav | 1.4.2_1,1 | fixed | |
| OpenBSD | security/clamav | 1.5.4 | out of range, by version | |
| NetBSD | security/clamav | 1.4.6nb1 | not listed | |
| MidnightBSD | security/clamav | 1.5.4_1,1 | out of range, by version | |
| FreeBSD | security/clamav | 1.5.4_2,1 | fixed | (579 days after) |
| FreeBSD | security/clamav-lts | 1.4.6_1,1 | fixed | (624 days after) |
| MidnightBSD | security/clamav-lts | 1.4.6_1,1 | out of range, by version |