Threats tagged 'ghsa-vhq6-cjc8-x8v9'

CVE-2024-20328 is a vulnerability in the VirusEvent feature of ClamAV that allows a local attacker to inject arbitrary commands with the privileges of the application service account. This occurs due to unsafe handling of file names containing command-line sequences. Exploitation requires local access and the use of specific VirusEvent configurations. ClamAV has released updates to address this issue, and no workarounds are available.