CVE-2019-1785

Clam AntiVirus RAR Directory Traversal Vulnerability

State: Published
Severity: 9.8 Critical
Published: Apr 8, 2019
Updated: Nov 19, 2024
Reserved: Dec 6, 2018

Description

A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
ClamAVCisco	0.101.1Affected 0.101.0Affected

References

https://bugzilla.clamav.net/show_bug.cgi?id=12284
GLSA-201904-12vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.