CVE-2021-1405
Clam AntiVirus (ClamAV) PDF Parser Denial of Service Vulnerability
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 8, 2021
- Updated
- Nov 8, 2024
- Reserved
- Nov 13, 2020
Description
A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted email to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | cisco |
Weaknesses
- CWE-120 Buffer Overflow
Affected Products
| Product | Versions |
|---|---|
ClamAVCisco |
|
References
- https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.htmlvendor-advisory
- [debian-lts-announce] 20210414 [SECURITY] [DLA 2626-1] clamav security updatemailing-list
- GLSA-202104-07vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.