Cisco has rolled out security updates to address a critical flaw reported in the ClamAV open source antivirus engine that could lead to remote code execution on susceptible devices.
“This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write,” Cisco Talos said in an advisory.
“An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device.”
“This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection,” Cisco noted.
“An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device.”
Cisco separately also resolved a denial-of-service vulnerability impacting Cisco Nexus Dashboard and two other privilege escalation and command injection flaws in Email Security Appliance and Secure Email and Web Manager.
