BSD Portsclamav -- Multiple vulnerabilities
· CVE-2026-20345, CVE-2026-20339, CVE-2026-20346, CVE-2026-20347, CVE-2026-20348, CVE-2025-8088, CVE-2026-20217, CVE-2026-20213, CVE-2026-20216, CVE-2026-20214, CVE-2026-20243, CVE-2026-20215, CVE-2026-20244 · VuXML entry
The ClamAV project reports: CVE-2026-20345: indexing error while converting GPT partition names could read or write beyond a stack-allocated partition entry. CVE-2026-20339: integer overflow in the PESpin unpacker could allocate an undersized buffer and write beyond it. CVE-2026-20346: integer underflow in the PDF parser could cause a crash while reading a malformed hex string. CVE-2026-20347: undefined behavior and …
Affected versions
- clamav < 1.5.4,1
- clamav-lts < 1.4.6,1
By system
1 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/clamav | 1.4.2_1,1 | vulnerable since 2026-10-09 | |
| OpenBSD | security/clamav | 1.5.4 | out of range, by version | |
| NetBSD | security/clamav | 1.4.6nb1 | not listed | |
| MidnightBSD | security/clamav | 1.5.4_1,1 | out of range, by version | |
| FreeBSD | security/clamav | 1.5.4_2,1 | fixed | |
| FreeBSD | security/clamav-lts | 1.4.6_1,1 | fixed | |
| MidnightBSD | security/clamav-lts | 1.4.6_1,1 | out of range, by version |