PT-2019-14495 · Clam Antivirus+3 · Clamav+3
Publicado
2019-11-21
·
Atualizado
2026-02-06
·
CVE-2019-15961
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Clam AntiVirus (ClamAV) versions 0.102.0, 0.101.4 and prior
Description
A vulnerability in the email parsing module could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The issue is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this by sending a crafted email file to an affected device, allowing the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.
Recommendations
For versions 0.102.0 and prior, update to version 0.102.1 or later.
For version 0.101.4 and prior, update to version 0.101.5 or later.
As a temporary workaround, consider restricting the processing of specially formatted email files until a patch is applied.
Exploit
Correção
DoS
Resource Exhaustion
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Clamav
Suse
Ubuntu