CVE-2021-1405
Assigner: cisco
Published: 2021-04-08T00:00:00
State: PUBLISHED
affected: product: ClamAV
vendor: Cisco
versions: lessThanOrEqual: 0.103.1
status: affected
version: unspecified
versionType: custom
datePublic: 2021-04-08T00:00:00
descriptions: value: A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted email to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-120
description: CWE-120 Buffer Overflow
type: CWE
source: advisory: https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html
discovery: UNKNOWN
title: Clam AntiVirus (ClamAV) PDF Parser Denial of Service Vulnerability
x_generator: engine: Vulnogram 0.0.9