clamav-1.4.3-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:15211-1 Final 1 1 2025-07-03T00:00:00Z current 2025-07-03T00:00:00Z 2025-07-03T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z clamav-1.4.3-1.1 on GA media These are all security issues fixed in the clamav-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-15211 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-20234/ SUSE CVE CVE-2025-20234 page https://www.suse.com/security/cve/CVE-2025-20260/ SUSE CVE CVE-2025-20260 page openSUSE Tumbleweed clamav-1.4.3-1.1 clamav-devel-1.4.3-1.1 clamav-docs-html-1.4.3-1.1 clamav-milter-1.4.3-1.1 libclamav12-1.4.3-1.1 libclammspack0-1.4.3-1.1 libfreshclam3-1.4.3-1.1 clamav-1.4.3-1.1 as a component of openSUSE Tumbleweed clamav-devel-1.4.3-1.1 as a component of openSUSE Tumbleweed clamav-docs-html-1.4.3-1.1 as a component of openSUSE Tumbleweed clamav-milter-1.4.3-1.1 as a component of openSUSE Tumbleweed libclamav12-1.4.3-1.1 as a component of openSUSE Tumbleweed libclammspack0-1.4.3-1.1 as a component of openSUSE Tumbleweed libfreshclam3-1.4.3-1.1 as a component of openSUSE Tumbleweed A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . CVE-2025-20234 openSUSE Tumbleweed:clamav-1.4.3-1.1 openSUSE Tumbleweed:clamav-devel-1.4.3-1.1 openSUSE Tumbleweed:clamav-docs-html-1.4.3-1.1 openSUSE Tumbleweed:clamav-milter-1.4.3-1.1 openSUSE Tumbleweed:libclamav12-1.4.3-1.1 openSUSE Tumbleweed:libclammspack0-1.4.3-1.1 openSUSE Tumbleweed:libfreshclam3-1.4.3-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-20234.html CVE-2025-20234 https://bugzilla.suse.com/1245055 SUSE Bug 1245055 A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process. CVE-2025-20260 openSUSE Tumbleweed:clamav-1.4.3-1.1 openSUSE Tumbleweed:clamav-devel-1.4.3-1.1 openSUSE Tumbleweed:clamav-docs-html-1.4.3-1.1 openSUSE Tumbleweed:clamav-milter-1.4.3-1.1 openSUSE Tumbleweed:libclamav12-1.4.3-1.1 openSUSE Tumbleweed:libclammspack0-1.4.3-1.1 openSUSE Tumbleweed:libfreshclam3-1.4.3-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-20260.html CVE-2025-20260 https://bugzilla.suse.com/1245054 SUSE Bug 1245054