CVE-2020-37167

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-37167
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37167.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-37167
Downstream
Published
2026-02-12T23:16:08Z
Modified
2026-10-20T13:59:39Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

References

Affected packages

Git / github.com/cisco-talos/clamav

Affected ranges

Type
GIT
Repo
https://github.com/cisco-talos/clamav
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
854d38de546a53e3c27b90965b8d89804acfdf02
Fixed
cd2f2975b93277de7f74464d48adb378375a305f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.103.0-rc"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "fixed": "cd2f2975b93277de7f74464d48adb378375a305f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

clamav-0.*
clamav-0.101.0
clamav-0.102.0
clamav-0.96
clamav-0.96.2
clamav-0.96.3
clamav-0.96.4
clamav-0.96.5
clamav-0.96rc1
clamav-0.96rc2
clamav-0.97
clamav-0.97rc
Other
merge-llvm-97877
r5076

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37167.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "22599797907414722464659801424665383648",
            "length": 1692
        },
        "id": "CVE-2020-37167-0bb8cd9a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamdscan/client.c",
            "function": "ping_clamd"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "258287229122960066526305161540484572432",
                "133108484896280132026513204697044915602",
                "38027455530152731521457639074083325444",
                "334715647810890587684562740399179295986",
                "132210115132739307668679821357348402644",
                "263853581888740915156239612409111587608",
                "42968746016626670686991226537921830763",
                "260257863686603665939650277053984918847",
                "220567141142655036135912109351945055839",
                "149462719253495444496128443065781267673",
                "316517136435113683594703126397423496278",
                "263383921687464260618757621048515819182",
                "48478377143763010323375369616564318153",
                "299470815158447234819819084245330539176",
                "261246768202589690387643506820491034233"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-233b5bf6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/client/client.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "197692853761140123394134975151252655034",
            "length": 4001
        },
        "id": "CVE-2020-37167-3eae5241",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/fanotif/fanotif.c",
            "function": "onas_fan_eloop"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "6845275656085664560088075897144213936",
                "50689903831671583891477432400696470735",
                "223326227844162913378380033664841594055",
                "320681948466540779391556695050337045172",
                "230122812714160278193466679709994969691",
                "159334995745666464516584562300527750367",
                "309809507576000561625069053602198310142",
                "300330702863222041840563659389777240399",
                "2184814101818528581220296403356643098",
                "170080545262882321936465775455807325514",
                "296254465832609572805911433507914815866",
                "190647568172116494054168821530729378546",
                "258978834744102205052721767860896258301",
                "184201634458679042124572481362381336157",
                "123198141682004011137815232927199668957",
                "183119939117662693545157007007466023882",
                "244135606051991190131181693302535240063",
                "191975519734993132613110455991681106780",
                "188933332893647046618490541354911426282",
                "20630535356722993715473930845302280819",
                "226726405492254546745532236264580055783",
                "222336147167216769668014840660181984073",
                "49781570555784704300353112434256247647",
                "37933920841237038430038530551373875877",
                "338393784924759878299127267506577183785",
                "103949058558527791647975358522082075119",
                "65210468753792666486205138799046404625",
                "260889484228942512848427071595474458681",
                "123198141682004011137815232927199668957",
                "235850219348437095255029026338633748320",
                "119736940987488281810636859698464316178",
                "304097156400467290339778237691487003794",
                "133948063648740558878178176123096545073",
                "20630535356722993715473930845302280819",
                "119511100040818730193325444631767055164",
                "103949058558527791647975358522082075119",
                "65210468753792666486205138799046404625",
                "260889484228942512848427071595474458681",
                "123198141682004011137815232927199668957",
                "235850219348437095255029026338633748320",
                "119736940987488281810636859698464316178",
                "304097156400467290339778237691487003794",
                "133948063648740558878178176123096545073",
                "20630535356722993715473930845302280819",
                "268914868530021619653321014453059332457",
                "251708787152002751274355528628130532425",
                "221137233623842586257957803433295281780",
                "152317589571608611438770330046890487698",
                "287651660223196751578897743495699241508",
                "193599235760642131941041926240560719133",
                "129120019329052947016011480355853062727",
                "185612567544745537091248657832925749399",
                "60781389010781988090877390348196530061",
                "182420246007371667135571683299079810633",
                "185066527277473664791333257383160992726",
                "276231423024067077062025623181744134391",
                "128822010294807620674824694987717734041",
                "209673568854727159447863844106425086180",
                "126744712666990703653295411257570214064",
                "290692811495672805492180150306945144996",
                "331826025145942487030688759601962586886",
                "285416895403243955336592876352248839352",
                "287840222199849201322841316273294291566",
                "315006728337680501052086358162816442601",
                "339153014545636521224386745368776929896",
                "315866164810021375671746758468536105291",
                "86059711692568332097677067060712989501",
                "213865648247573706925187704589173101815",
                "293623503023221385839700657467411387061",
                "271583499172885086344222382544513708196",
                "282495565758324722113739334878465362658",
                "115557254543987910608036579623045446034",
                "333186355939847916761955695618609159578",
                "266221793299317849897135862048333214471",
                "76883067893616298334838768804030944545"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-42a87723",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/clamonacc.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "189616802374571960905732736673932876259",
                "260765539758725929754043961912144044434",
                "144282043768447633786446550525450574074",
                "109473368415169997600699099485099052240",
                "229032267276227490599492869478494449334",
                "38156694841526526591947071059980947062",
                "30860247435651971081354231760941232424",
                "44182189279614837749618283789919124922",
                "188724235052366195665789727964930705570",
                "191797690572595724652906820151066817009"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-60c142a7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/fanotif/fanotif.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "155062218303651394716261876469331177575",
            "length": 2423
        },
        "id": "CVE-2020-37167-6db5e858",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamdscan/client.c",
            "function": "client"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "148459003788419734165499019283961617796",
            "length": 9596
        },
        "id": "CVE-2020-37167-6e495cb5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
        "target": {
            "file": "clamscan/clamscan.c",
            "function": "help"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "58161993787548219215208658096686786564",
            "length": 2422
        },
        "id": "CVE-2020-37167-793d62f3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/clamonacc.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "106408459869373235257750722575119413454",
                "240679148377164762295485940777004739424",
                "337586465132289121067143456422797591531",
                "148429844097337696780210272830939777011"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-834fecc2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
        "target": {
            "file": "clambc/bcrun.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "322656259478487021347026451652293671019",
            "length": 2337
        },
        "id": "CVE-2020-37167-8d3dd66a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/client/client.c",
            "function": "onas_setup_client"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "300135742121329154209605564707232899265",
                "25711749993336170408433539590972442926"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-9001bfb9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/client/client.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "167592726635174250239689365165810359384",
            "length": 3469
        },
        "id": "CVE-2020-37167-a2d15065",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamdscan/clamdscan.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "303164250971930418116974909361803411375",
                "183853009528802975421205441851847665370",
                "200453439829448750915990055448628651586",
                "287326728582701155732152354563803866722",
                "187217884733339712565056533912393872962",
                "309170341801048815291552660729452112206",
                "147426611498457289175504768742166715778",
                "308206121529535185804869176557320995783",
                "228312128693998983666007601259717011891",
                "144996954544113916757003117901917599870",
                "274780052270896860577139250761695056667",
                "26311835423531471178088397702577170565",
                "174007288110686531387118601143472292577",
                "129583144252923439954253883037906775642",
                "14123288974262166687983445941638226429"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-b7350eee",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamdscan/clamdscan.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "319099642839516231756972946597436079926",
            "length": 2411
        },
        "id": "CVE-2020-37167-b7e1f87a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/client/client.c",
            "function": "onas_ping_clamd"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "191718247534306042539625511569012605262",
                "58756646025466442967636112104272047953",
                "158072926320145078770359338928999650907",
                "79570584781485255077898755623269705818"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-d1261cec",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
        "target": {
            "file": "clamscan/clamscan.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "45369902672771399579418896259376023236",
                "257732791402044802477535629200112672913"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-d1926656",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamdscan/client.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "168312060395043906144956489134026369479",
            "length": 2266
        },
        "id": "CVE-2020-37167-d1ac01a6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamonacc/clamonacc.c",
            "function": "startup_checks"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "241550728163143469195026663349662122787",
            "length": 1558
        },
        "id": "CVE-2020-37167-d7cd692b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
        "target": {
            "file": "clambc/bcrun.c",
            "function": "help"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "132210115132739307668679821357348402644",
                "263853581888740915156239612409111587608",
                "153769866360549751517053371999144117168",
                "174860194568382827426371977075546086954",
                "140942041530502039217728563574097850291",
                "91830639276270041671959622792138358307",
                "44996583680097789446604547727552262554",
                "112977669965290971764224319629427654775",
                "322817037530276858492348658517070223190"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-37167-f412a8eb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
        "target": {
            "file": "clamdscan/client.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-20T13:59:39Z"