{"id":"CLSA-2026-1784210640","summary":"Fix CVE(s): CVE-2026-20215, CVE-2026-20216, CVE-2026-20217","details":"   * SECURITY UPDATE: Out-of-bounds write via 7z substream count overflow\n     - debian/patches/CVE-2026-20215.patch: reject 7z archives whose total\n       unpack-stream count would overflow UInt32 before it is accumulated in\n       libclamav/7z/7zIn.c\n     - CVE-2026-20215\n   * SECURITY UPDATE: Denial of service via InstallShield extraction size-limit bypass\n     - debian/patches/CVE-2026-20216.patch: enforce maxfilesize and maxscansize\n       against the cumulative inflated output and propagate hard-stop limit\n       errors out of is_extract_cab() in libclamav/ishield.c\n     - CVE-2026-20216\n   * SECURITY UPDATE: Invalid free in the PESpin unpacker cleanup loop\n     - debian/patches/CVE-2026-20217.patch: shift the working bitmap instead of\n       bitman in the PESpin cleanup loop so only unpacker-allocated sections are\n       freed in libclamav/spin.c\n     - CVE-2026-20217","modified":"2026-10-26T09:31:47.205719224Z","published":"2026-07-16T14:04:28Z","upstream":["CVE-2026-20215","CVE-2026-20216","CVE-2026-20217"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1784210640.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20215"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20216"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20217"}],"affected":[{"package":{"name":"clamav","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamav-base","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-base?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamav-daemon","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-daemon?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamav-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamav-docs","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-docs?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamav-freshclam","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-freshclam?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamav-milter","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-milter?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamav-testfiles","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamav-testfiles?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"clamdscan","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/clamdscan?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"libclamav-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libclamav-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}},{"package":{"name":"libclamav12","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libclamav12?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210640.json"}}],"schema_version":"1.9.0"}