{"id":"CLSA-2026-1784110349","summary":"Fix CVE(s): CVE-2026-20213, CVE-2026-20214, CVE-2026-20244","details":"   * SECURITY UPDATE: Out-of-bounds write in the PE rebuilder via crafted Aspack files\n     - debian/patches/CVE-2026-20213.patch: sum rebuilt section sizes in a\n       64-bit accumulator and reject allocations larger than CLI_MAX_ALLOCATION\n       in libclamav/rebuildpe.c\n     - CVE-2026-20213\n   * SECURITY UPDATE: Out-of-bounds write in the FSG unpacker\n     - debian/patches/CVE-2026-20214.patch: fix the FSG v1.31 section loop\n       bound so a zero section count no longer underflows in libclamav/pe.c\n     - CVE-2026-20214\n   * SECURITY UPDATE: Integer overflow in the DMG mish stripe size checks\n     - debian/patches/CVE-2026-20244.patch: compute the mish table size in a\n       64-bit domain and keep the DMG range checks in subtraction form in\n       libclamav/dmg.c\n     - CVE-2026-20244","modified":"2026-10-26T09:31:47.212228859Z","published":"2026-07-15T10:12:44Z","upstream":["CVE-2026-20213","CVE-2026-20214","CVE-2026-20244"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1784110349.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20213"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20214"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20244"}],"affected":[{"package":{"name":"clamav","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamav-base","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-base?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamav-daemon","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-daemon?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamav-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamav-docs","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-docs?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamav-freshclam","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-freshclam?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamav-milter","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-milter?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamav-testfiles","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-testfiles?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"clamdscan","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamdscan?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"libclamav-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libclamav-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}},{"package":{"name":"libclamav12","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libclamav12?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784110349.json"}}],"schema_version":"1.9.0"}